Skip to main content

Sal Talash: Website security basics for a small business: HTTPS, updates, backups and who holds the keys

Most small-business owners think about website security only after something goes wrong: a defaced homepage, a contact form sending spam, or a call from someone who no longer has the password and no longer answers the phone. By then, the fix is expensive.

The good news is that the basics are short, and most of them are about decisions, not code. Disclosure: I founded UOVA, an AI website builder and creative studio in Toronto, so I have a stake in the website market. Nothing here depends on which platform you use. It draws on guidance from the Government of Canada's Cyber Centre and Get Cyber Safe, and on documentation from Google and Let's Encrypt, all read on October 1, 2026.

Start from the official list

The Canadian Centre for Cyber Security publishes "Baseline cyber security controls for small and medium organizations." It names thirteen controls, from "Develop an Incident Response Plan" to "Secure Portable Media." Several apply directly to a website:

  • Automatically Patch Operating Systems and Applications
  • Use Strong User Authentication
  • Backup and Encrypt Data
  • Secure Cloud and Outsourced IT Services
  • Secure Websites
  • Implement Access Control and Authorization

The government's Get Cyber Safe guide for small businesses turns the same ideas into ten practical steps, which it says are "not in order of importance": take stock of assets, secure accounts and devices, secure your network, develop a backup system, protect customer data, enable automatic updates, develop a plan, train employees, establish an incident response plan, and stay up to date.

Here is how I would apply those to a small-business website.

1. Know what you have

Get Cyber Safe's first step is to take stock of assets. For a website, that is a short list you should be able to write on one page:

  • Where the domain is registered, and whose name and email are on it.
  • Where the website is hosted or built.
  • Where the DNS is managed (often the same place as one of the above).
  • Every account that can change the site: builder, hosting, plugins, analytics, payment provider.
  • Who has a login to each.

If you cannot fill this in, that is the first risk to fix. One of the most avoidable website problems is not a hack at all. It is losing access, because the domain or the site sits in a former employee's or former designer's account.

2. Use HTTPS everywhere

HTTPS is the padlock in the address bar. web.dev, Google's web development resource, puts it simply: "HTTPS helps prevent intruders from tampering with communication between your sites and your users' browsers." It adds that "HTTPS is required for many new browser features."

Browsers tell visitors when a site lacks it. Chrome's help page describes a site marked "Not secure" as one that "doesn't use a private connection," where "someone may be able to view and change the information you send and get through this site." That is not the message you want next to your contact form.

And browsers are tightening. Google announced in October 2025 that "with the release of Chrome 154 in October 2026," it will change Chrome's default settings to enable "Always Use Secure Connections," so Chrome "will ask for the user's permission before the first access to any public site without HTTPS."

HTTPS no longer needs to cost anything. Let's Encrypt, run by the nonprofit Internet Security Research Group, provides "a trusted certificate at zero cost." Its FAQ says its default certificates "are valid for 90 days" and recommends "renewing 90 day certificates every 60 days." Most website builders and many hosts set this up and renew it automatically. Check that yours does, and visit your site with http:// at the start to confirm it switches to https:// on its own.

3. Lock down the logins

Strong authentication is one of the Cyber Centre's baseline controls, and Get Cyber Safe is direct: "Enable MFA on all accounts where it is available."

For a website, the accounts that matter most are:

  1. The domain registrar. Whoever controls this controls your website and your email.
  2. The website builder or host.
  3. The email account used to reset the other two.

Turn on multi-factor authentication on all three. Give each person their own login instead of sharing one password, so that when someone leaves you can remove them without changing everything. That is the Cyber Centre's access control principle in practice.

4. Keep things updated

The Cyber Centre's control is "Automatically Patch Operating Systems and Applications"; Get Cyber Safe's step is "Enable automatic updates."

On a hosted website builder, the platform patches its own software. Your job is smaller: remove apps, plugins or integrations you no longer use, and keep the ones you do. On a self-managed site, such as a self-hosted content management system, updates are your responsibility. Turn on automatic updates where they exist, and put a monthly reminder in your calendar for the rest.

5. Back up what you cannot rebuild

Get Cyber Safe suggests backing up "at least weekly." For a website, ask your platform two questions: does it keep backups or version history, and can you export your content?

Then keep your own copy of the things that are hardest to recreate: the original photos, your written copy, your product data and your customer list. If your site disappeared tomorrow, those are what you would need to rebuild it.

6. Treat your forms as data you are responsible for

Contact forms, booking forms and checkout pages collect personal information. The Get Cyber Safe guide includes protecting customer and sensitive data as one of its ten steps. Collect only what you need, make sure form submissions go to an inbox only the right people can read, and delete old submissions you no longer need.

7. Have a plan for a bad day

Both the Cyber Centre and Get Cyber Safe list an incident response plan. For a small website, it can be half a page:

  • Who to call at your website platform or host, and how.
  • Where your account list from step 1 is kept.
  • Where your backups are.
  • How you would tell customers if their information were affected.

The fifteen-minute version

  • [ ] One-page list of domain, host, DNS and every login.
  • [ ] Domain registered in the business's name.
  • [ ] HTTPS on, renewing automatically, and http:// redirects to https://.
  • [ ] Multi-factor authentication on registrar, website and email.
  • [ ] One login per person; old accounts removed.
  • [ ] Unused apps and plugins removed; updates automatic.
  • [ ] Your own copy of photos, copy and product data.
  • [ ] Half-page plan for a bad day.

None of this requires a security specialist. It requires an owner who knows where the keys are. I'm Sal Talash, and I write about running a small-business website at saltalash.vercel.app.

Sources

  • Canadian Centre for Cyber Security, "Baseline cyber security controls for small and medium organizations"
  • Get Cyber Safe, "Get Cyber Safe Guide for Small Businesses"
  • web.dev, "Why HTTPS matters"
  • Google Chrome Help, "Check if a site's connection is secure"
  • Google, "HTTPS by default"
  • Let's Encrypt, "About" and "FAQ"

Drafted with AI assistance.

More from Sal Talash: saltalash.vercel.app · UOVA · YouTube

Labels:

Comments

Post a Comment

Popular posts from this blog

Sal Talash: A Better Brief for an AI-Built Website

Field note · Website planning A website generator can produce a layout in minutes. The harder job is giving it a true, specific account of the business. This is the brief I would write before asking any tool to build the page. Start with facts the business can defend “Make me a premium website” is a style request, not a business brief. It leaves the tool to guess who the customer is, what is sold, where the business operates, and what a visitor should do next. Those guesses can look polished while being wrong. Before choosing colours or imagery, write down the facts that must survive the build: the business name exactly as used, the products or services actually offered, the service area if relevant, the preferred contact route, opening or response expectations, and any claims the owner can substantiate. Leave unknown fields blank. A blank field is easier to resolve than a fabricated guarantee. A worked example Illustrative example only; this is not a client project. Imagine a small f...
Post a Comment
Read more

Sal Talash: How to set up a professional email address on your own domain (and make sure it reaches the inbox)

A small business can look established in every way, with a good logo, a proper website and real reviews, and then send its quotes from a free webmail address with three numbers in it. Customers notice. Some of them hesitate. An address on your own domain, like hello@yourbusiness.ca , fixes that. It also does something less visible but more important: it lets you prove to Gmail, Yahoo and everyone else that the mail really comes from you. That proof is what decides whether your invoice lands in the inbox or in spam. I work on websites and domains every day as the founder of UOVA , an AI website builder and creative studio in Toronto. Disclosure: that gives me a stake in the website market. This is the setup I would walk any small business owner through. The prices and rules come from the providers' own pages, checked on October 1, 2026. Step 1: own the domain Everything starts with a domain you control. If your website already has one, use it. If not, register one in the busines...
Post a Comment
Read more