Website security for SMBs: HTTPS, backups, updates

"We're too small for hackers to bother with." It's the line we hear most often when security comes up with a client, and it rests on a false picture: a human who picks a target, studies the business, then attacks. In our web services, the question is never "who would want to attack us", it's "what answers when a program knocks".

Because what knocks is a program. Bots crawl the web continuously, spot vulnerable plugins and try passwords. They don't know what you sell and they don't care. Sucuri, which cleans compromised sites all year long, puts it plainly: attackers use automated scripts to scan the internet for susceptible sites, and these opportunistic attacks exploit known weaknesses.

That distinction changes what's worth doing, and above all what isn't. Here are the measures that actually stop automated traffic, plus the legal side most Quebec business owners never hear about.

The short answer, for the busy

Small business website security is a contest against automated programs, not against attackers who singled you out. Bots sweep the web continuously looking for an outdated plugin or a weak password, and your server interests them for what it is: a machine with a decent reputation, useful for hosting spam pages, redirecting your visitors to fraudulent sites and relaying email. Five measures stop the large majority of it: HTTPS everywhere, updates applied fast (Patchstack measures a five-hour median before the first exploitation of a WordPress flaw), accounts limited to least privilege with two-factor authentication, offline backups whose restore has actually been tested, and form abuse protection. In Quebec, handling this isn't optional: section 10 of the Act respecting the protection of personal information in the private sector requires every enterprise to take reasonable security measures to protect the personal information it holds.

You're not targeted, you're swept up

The raw numbers make the best argument. In its annual report covering 2024, Wordfence says it logged over 54 billion malicious requests from 209 million distinct IP addresses, and blocked over 55 billion password attacks. There is no human decision behind those numbers: everything gets shot at, and whatever falls is collected.

A twelve-person company gets exactly the same treatment as a 500-person one. Nobody is paying you more or less attention; what differs is what answers. An up-to-date site returns an error and the bot moves on within milliseconds. A site with a plugin abandoned two years ago gets compromised before anyone notices the visit.

So you don't need an enterprise security apparatus. You need to not be the site that answers.

What your server is worth to a bot

Second misconception: "we have nothing to steal". Most of the time the loot isn't your data, it's your server and the reputation of your domain.

A compromised site is mainly good for three things. Hosting SEO spam: Sucuri detected SEO spam on 20.30% of the infected sites it remediated in 2023, often hidden links to gambling or counterfeit pharmacy sites. Redirecting your visitors to phishing. And keeping a way back in: 49.21% of compromised sites contained at least one backdoor, and 55% of sites with an infected database held a malicious admin user, created to regain control after cleanup.

These infections are also built to stay invisible. Patchstack's 2026 report, which folds in Monarx's server-level detection data, describes campaigns that sort visitors: search engine bots get keyword-stuffed pages, humans get redirected to fraudulent sites, and the site owner sees clean content. So the compromise surfaces when Google rankings collapse, which is to say long after the fact.

HTTPS: the floor, and soon a condition of entry

HTTPS is ground level now: certificates are free and automated at every serious host, which settles the cost question (we covered what a web hosting bill actually pays for elsewhere). What changes in 2026 is browser behaviour. Google announced on 28 October 2025 that Chrome would enable the "Always Use Secure Connections" setting by default with Chrome 154, in October 2026: it will ask the user's permission before the first access to any public site without HTTPS. The step before that lands sooner, in Chrome 147 in April 2026, for the billion-plus users on Enhanced Safe Browsing. If one of your old URLs still redirects over HTTP, some of your visitors will see a warning before they reach you.

Updates: a window measured in hours

This is where most SMBs lose, and the reason is a misunderstanding about how much time you have. Patchstack, whose data was updated on 25 February 2026, measured the gap between public disclosure of a WordPress flaw and the first observed exploitation attempt: roughly half of high-impact vulnerabilities are exploited within 24 hours, and the weighted median is five hours. A published patch is also the starting gun for attackers, who now know exactly what to look for. Of the 11,334 vulnerabilities recorded in the WordPress ecosystem in 2025, 1,966 (17%) carried a high severity score, meaning they were likely to be exploited in automated mass-scale attacks.

And no, your host does not cover you. Patchstack ran two penetration studies in 2025 against common defences (hosts' internal web application firewalls, Cloudflare, security suites): they blocked 12% of WordPress-specific vulnerability attacks in the first test, 26% of total attacks in the second, broader one. A firewall buys time, it doesn't replace the update.

This is where security and website maintenance meet without being the same thing. Maintenance fights decay: an expiring certificate, a form that stops sending. Security fights someone. Decay doesn't speed up when you look away. An adversary does.

Accounts and forms: the front door

Those 55 billion password attempts Wordfence counted are a reminder that the simplest route is still walking in the front door. The team also notes that hosting account credential compromise is a frequent source of intrusion among the sites it cleans.

First, least privilege: the person publishing blog posts doesn't need an administrator account, and the agency that built the site four years ago doesn't need access at all. Second, two-factor authentication on every account that offers it (site, host, domain registrar, mailbox). Microsoft's 2023 study of Azure Active Directory accounts showing suspicious activity measured a 99.22% reduction in compromise risk with multifactor authentication, and 98.56% in cases of known credential leaks: the best effort-to-result ratio on this whole list. Third, form protection, the one door you open on purpose: rate limiting, an invisible honeypot field, server-side validation. An unprotected form ends up serving as a spam relay, and it's your domain that lands on the blocklists.

Backups: the ones you never restored don't count

Everyone has backups. Almost nobody has confirmed they restore. The Canadian Centre for Cyber Security is explicit about this in its baseline cyber security controls for small and medium organizations: organizations should have clear procedures on how to restore from backups and regularly verify that backup and restore mechanisms operate as expected. Its BC.7.2 control adds that long-term backups must be stored offline, while frequent daily backups may stay online.

Two mistakes cancel the whole benefit. The backup stored on the same server as the site, which disappears with it. And the backup restored without thinking after an infection: if the backdoor was already in the archive, you just reinstalled the attacker along with your content. Hence the value of keeping several restore points spread over time.

Section 10 of Law 25 makes it an obligation

In Quebec, the security of a site that collects personal information (a contact form is enough) is also a matter of law. Section 10 of the Act respecting the protection of personal information in the private sector is short: a person carrying on an enterprise must take the security measures necessary to ensure the protection of the personal information, reasonable given the sensitivity of the information, the quantity and distribution of the information and the medium on which it is stored.

The failure is sanctioned explicitly. Section 90.1 lets the Commission d'accès à l'information impose an administrative monetary penalty on anyone who fails to take security measures in accordance with section 10, up to $10,000,000 or 2% of worldwide turnover (section 90.12), and section 91 makes it a penal offence carrying a fine of $15,000 to $25,000,000 or 4%. Let's be honest: no Quebec SMB is getting a $10M fine over an outdated plugin. The realistic cost sits elsewhere, in the obligations that follow an incident: notifying the Commission and the individuals concerned where there is a risk of serious injury (section 3.5) and keeping a register of confidentiality incidents (section 3.8), which the Commission can demand. Our article on Law 25 and your website covers the cookies and forms side.

None of this takes an enterprise budget. HTTPS is free, two-factor authentication is free, removing three stale accounts takes ten minutes, testing a restore takes an hour a quarter. What costs real money is finding out six months late that your domain is hosting spam pages.

→ Request an audit of your site

This article explains legal obligations to help an SMB ask the right questions; it is not legal advice. The text of the Act respecting the protection of personal information in the private sector and the positions of the Commission d'accès à l'information govern: for your specific situation, consult a lawyer.