Small business cyber security — where to start with your website

A conversation about cyber security for a small business usually starts with the firewall and the plugins. The data says to start somewhere else.

The EU's cybersecurity agency, ENISA, analysed 4,875 incidents across the Union for its Threat Landscape 2025, covering July 2024 to June 2025. Phishing — by email, by phone, through malicious ads — accounts for about 60% of the ways attackers got in. Exploiting a flaw in software accounts for 21.3%. In other words, somebody getting hold of a login is roughly three times as common as somebody breaking through the code. The Polish national figures point the same way, only more sharply: in 2025 CERT Polska, the national incident response team, registered 260,783 incidents. Break-ins were 750 of them — three tenths of a per cent. Computer fraud was 97%, and the theft of logins and passwords alone 30% of everything. Nobody is likely to break in the way you imagine. Somebody will simply get a password.

That is why this section is built around access, not tools — and why it starts with a list of accounts, not with a purchase. Below are six situations, one per article. I do not teach any of them from the beginning here; that is what the articles I point to are for.

If you do only one thing

Open the list of users in your website's dashboard and, for each account, answer three questions: who is this, do they still use it, and do they need these permissions?

What usually turns up is the account of a contractor from two agencies ago, the "admin" account from the installation, and three people with administrator rights of whom one actually edits. On top of that come three kinds of access the dashboard does not show and that give more than an administrator account: the hosting, the database and the domain account.

A quarter of an hour, no cost, and it closes the route by which the large majority of incidents arrive. How to do it and what comes next: [how to secure a website](posts:69241af55f2464f7c72d876b).

If you have five minutes left after that quarter of an hour, spend them on one thing: check which email address receives the dashboard's password reset. It is sometimes a former employee's mailbox or an alias nobody reads — and whoever holds that mailbox holds the dashboard, without breaking anything.

Six ways into the section

"Somebody could break in — what should I actually do?"

Access control, dashboard accounts, plugins as an attack surface, and six signs that something has already happened — split into the ones you will notice yourself and the ones a customer sees first. This is also where the EU figures are laid out in full, together with the free checks almost nobody uses.

→ How to secure a website

"The browser warns people about my site" or "do I have to pay for a certificate?"

What a certificate is, when a free one is enough, when you need a wildcard, and what changes on dates none of you set — including shrinking certificate lifetimes and browsers moving towards HTTPS by default.

→ SSL certificate

"I have a dozen update notifications and I am afraid to click"

Where the vulnerabilities really sit — 91% in plugins, 9% in themes, six in the core — what to switch to automatic, what not to touch without your contractor, and what to do when an update takes the site down.

→ Website updates

"The hosting has backups — is that enough?"

The four layers a working site is made of, the three places a copy can live and what each protects against. And the part that changes the category of the problem: under the GDPR, losing access to personal data is a breach in its own right, with a 72-hour clock for notifying the Personal Data Protection Office (UODO).

→ WordPress backup

"Is our privacy notice in order?"

What the GDPR requires your site to tell people, what ends up in these texts by copying someone else's template, and cookie consent — with the rule on storing things in the visitor's browser that most sites read wrongly in one direction or the other.

→ GDPR and your privacy notice

"Do we even have anything to work with — who can check?"

If none of the sentences above sounds like your situation and you simply want to know what state the site is in, start with the quarter of an hour with the account list described above, then check your domain for free in Google Search Console, in Google's Safe Browsing lookup and with moje.cert.pl, the free domain check run by CERT Polska. You can do all three yourself, and all three will tell you more than any offer you receive without a check.

"An employee clicked a link"

The company layer: the mailbox, the phones, accounts in other people's systems. One reflex worth teaching the team instead of a course in spotting phishing, four moves after the click, and the protection you already use without knowing it.

→ Company data security

In what order to read it

Three paths, depending on what brought you here.

Nothing has happened and you simply want to get it in order. Start with the section above, then the section on order and backups. Three steps, one afternoon, and what is cheapest to close is closed.

Something has already happened. Go straight to how to secure a website, the section on what to do after a break-in — and if it is about a clicked link or a taken-over mailbox, to company data security. If what became unavailable or leaked included data about people, a deadline counted in hours comes on top: the GDPR and your privacy notice.

You are preparing for a conversation with your contractor. Read updates and backups: each of them produces specific questions you can ask in the meeting, and each ends with a list of what the answer should contain.

The order in which to do it

The order on this figure does not follow what is most interesting, but how much risk each item closes against the effort it takes. The first three are free and fit into one afternoon.

Notice where monitoring and the security plugin are: at the bottom. Not because they are useless, but because installed before the account list they create the feeling of having done something without closing the route people actually use. It is the most common mistake of order we see, and the most expensive one, because it costs a subscription and a false sense of calm at the same time.

One remark about the figure itself: these two measures are our assessment from audits, not a measurement. The caption says so too. The numbers that are measurements — the split of intrusion vectors and the split of incidents in Poland — are in the introduction and come from ENISA and CERT Polska.

A caveat on that number as well, because it belongs to the honesty of the argument: ENISA works mainly from open sources and from information shared by member states, and says itself that this is not a complete picture. Its dataset leans towards large, visible organisations — public administration is the most frequently hit sector in it — rather than towards a small company with a brochure site. For your decision that changes little: mass phishing campaigns do not check who they are writing to, and the proportion points the same way.

What is free, and what you pay for

It is worth saying plainly, because the security services market sells the opposite impression.

For nothing: the account list and removing unneeded access, a second login factor, unique passwords, removing unused plugins, checking where the password reset goes, reporting suspicious messages, checking your own domain in Google's tools.

For very little: a copy kept outside the hosting account. It is the only expense we recommend to practically everyone. In our maintenance cost calculator, a weekly backup is PLN 30 a month and a daily one PLN 60. Those are our prices, not a market average: we have not surveyed what others charge for this item alone.

Reasonably worth paying for when the site earns money: monitoring that alerts a named person, and technical maintenance with an agreed response time. The difference between "I find out within the hour" and "I find out from a customer a week later" can then be put into numbers — and that is the only way to justify the expense with a figure rather than a hunch.

There is also an in-between category that is rarely mentioned: the time of somebody who goes through all this for you once a quarter. Not monitoring, not a subscription — just an hour of work with the account list, the plugins and the backup. In a company where nobody opens the dashboard except to add a post, it is the best-spent hour in the whole section.

What is not worth buying: "premium security" packages bolted onto the hosting when nobody knows what they cover. There is one control question, and it settles the matter in a sentence — will this service alert a named person, or will it generate a report in a panel nobody opens?

What this section does not cover

• Who does it every month — technical maintenance, monitoring, support and what they cost: maintenance.
• What the site is built on — technologies.
• What you manage content with — tools.
• External deadlines that fall regardless of you — end of support for software versions and browser requirements: outdated website. That is a separate decision, driven by the calendar rather than by your symptoms.
• Legal rulings in doubtful cases. We describe what we see in implementations and cite the legal basis directly so that you can check it. In a dispute and for a risk assessment — a lawyer.

Three sentences that keep it on hold

"We are too small for anyone to be interested in us." Phishing campaigns do not choose targets — they replay credentials from other people's breaches and test well-known account names on everything that answers. Nobody checks the size of a company before trying to log in.

"The hosting takes care of that" or "our IT person does." They take care of their layer, and usually do it well. They are not responsible for the accounts in your dashboard, for abandoned plugins, or for whom you gave access three years ago. The GDPR puts it in its own terms: as the controller, it is you who must use only processors that provide sufficient guarantees (Article 28), and it is you whom the processor must notify of a breach (Article 33) — not the other way round.

"We will do it at the next redesign." The most expensive of the three, because the list in this section has nothing to do with a redesign — these are settings, not a project. Putting them off until the next big job usually means two years of open access in exchange for nothing.

What they have in common: each of these sentences shifts responsibility onto something external — the size of the company, the supplier, the calendar. The list that actually works is entirely internal, and that is why it is often the hardest to start.

There is a fourth sentence, rarer but worth noting because it sounds more reasonable than the others: "we will do it when we have the budget." For this list, budget is not the bottleneck — the three most effective items cost nothing, and the only one we recommend to practically everyone costs PLN 30 a month with us. The bottleneck is the decision about who in the company opens the dashboard and removes access from a person you enjoyed working with. That is uncomfortable, and that is why it slides through the calendar under another name.

What this section deliberately does not do

Finally, three things you will not find in these six articles, because we choose not to write them.

No frightening numbers without an origin. Every number in this section has a named, dated source, and where the source is a vendor with an interest in the result, we say so next to the number. From earlier versions of these texts we removed every statistic that could not be traced to anything.

No selling of tools. We do not compare plugins or providers: they change faster than an article can be kept current, and the right choice depends on what you already use.

No pretending to give legal advice. Where the law comes in, we cite the basis directly — with the article number and a link to the text — so that you can check it or show it to a lawyer. Doubtful cases belong to them.