Website security: 7 moves that protect your site and email

Why does website security matter for small businesses too?

“Who would bother with our site?” That thought is the biggest security gap of all. Most attacks aren’t carried out by people choosing a target, but by automated programs that scan thousands of sites looking for the first open door.

The numbers back this up. According to Verizon’s 2025 report (Data Breach Investigations Report), ransomware was present in 88% of breaches at small and medium-sized businesses, compared with 39% at large ones. And the human element played a role in about 60% of all breaches.

The good news is that most attacks can be stopped with simple measures. Website security starts with these seven moves.

Move 1: Keep your CMS, plugins, and themes updated

If your site runs on WordPress, plugins are its weakest point. Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024, and 91% of them involved plugins.

Turn on automatic updates wherever you can, check the rest every week, and delete anything you don’t use. A deactivated plugin that stays installed is still a risk.

And never install “cracked” (nulled) versions of paid plugins. They often come bundled with malicious code.

Move 2: Strong passwords and 2FA everywhere

Stolen passwords are one of the most common ways attackers get in. With two-factor authentication (2FA), meaning a second code from an app on your phone, they become almost useless. According to Microsoft, an account with 2FA is more than 99.9% less likely to be compromised.

Turn on 2FA for your site admin, email, hosting, domain, and ad accounts. Use a password manager so that every service has a different password.

Also give each person their own account, with only the permissions they need, rather than one shared “admin” for the whole team. When someone leaves, you close one account instead of changing every password.

Move 3: Backups you’ve tested

A backup is your safety net when everything else fails. A simple rule to follow is 3-2-1: three copies of your data, on two different types of media, with one of them off the server that hosts the site.

The most common mistake isn’t the lack of a backup; it’s a backup that was never tested. Once a quarter, do a trial restore in a staging environment. That’s the only way to know it will work on the day you need it.

For an e-shop, set up a daily database backup, because every day brings new orders.

Move 4: SSL and hosting that protects you

An SSL certificate, meaning the padlock and the “https” in the address, encrypts the data between the visitor and the site. Without it, Chrome shows a “Not secure” warning, and very few people will fill out a form on a page like that. Today you can even get one for free, so there’s no reason to go without. Just check that it renews automatically: an expired certificate shows a warning to every visitor.

Hosting matters just as much. A good hosting service offers a web application firewall (WAF), malware scanning, DDoS protection, and daily backups. The cheapest option often turns out to be the most expensive the first time something goes wrong.

Move 5: Protect your email with SPF, DKIM, and DMARC

Without these three settings on your domain, anyone can send email that looks like it comes from you: fake invoices, payment requests, links to phishing pages aimed at your customers.

The SPF record defines which servers send email on your behalf. DKIM digitally signs every message. DMARC tells recipients what to do with messages that fail the check.

Since February 2024, Gmail and Yahoo have required them from anyone sending more than 5,000 emails a day, and Microsoft followed suit for Outlook in May 2025. Even if you send fewer, setting them up correctly helps keep your emails out of spam.

Move 6: Train your team on phishing

The costliest vulnerability often isn’t in your code but in your inbox. One convincing email “from the bank” or “from the courier” is enough for someone to hand over a password.

Give your team a short briefing twice a year. Three rules cover most cases:

• We never give out passwords by email or over the phone, to anyone.
• We check the sender’s address before clicking a link.
• We confirm every request for a payment or an IBAN change by phone.

Today, phishing also arrives by SMS or Viber message, so the same rules apply there too.

Move 7: Have a plan for when a crisis hits

If your site gets hacked tomorrow, who do you call? Who has the hosting and domain passwords? Write down the answers now, in a document that the people in charge know about.

If the breach involves customers’ personal data, the GDPR (Article 33) requires you to notify the Hellenic Data Protection Authority within 72 hours of becoming aware of it, unless there’s no risk to the people affected. Those 72 hours go by very quickly if you don’t know where to start.

Businesses in critical sectors are also covered by Law 5160/2024, which transposes the NIS2 Directive and, according to SEV, applies to about 2,000 businesses in Greece.

Security without the headache

None of these moves requires a big budget. What they do require is someone who carries them out consistently, not just after a problem has happened. If you want to start today, do three things: turn on 2FA for your email, make sure there’s a backup off the server, and delete the plugins you don’t use.

At CNCTECH, we take care of website maintenance and security: updates, backups, monitoring, email configuration, and immediate help if something goes wrong.