How to protect a small business website
We earn a commission if you buy through some links on this page, at no extra cost to you. It never affects the order. How we make money.
Most attacks on small sites are automated: bots trying passwords, scanning for old plugins or flooding the site. A few basic measures stop nearly all of them.
The checklist
- Turn on HTTPS everywhere.
- Keep software updated: your CMS, theme and plugins.
- Use strong, unique passwords for every admin account; make them with the password generator and keep them in a password manager.
- Turn on two-factor sign-in for admin, hosting and domain accounts.
- Back up automatically and test a restore.
- Put a web application firewall (WAF) in front of the site to block bad bots, known attacks and floods of traffic.
Choose a firewall
| Product | Price today | Free plan | Details |
|---|---|---|---|
| Cloudflare | Free plan, then USD 20 per month, annual | Yes | Pricing |
| AWS WAF | From USD 5 per month | No | Pricing |
| Sucuri | From USD 9.99 per month | No | Pricing |
Prices from vendor websites, checked 2026-10-12; they update automatically.
Compare Cloudflare vs Sucuri and Cloudflare vs AWS WAF.