Website security in short
To secure a small business website, start with the basics that stop most automated attacks: keep your CMS, plugins and themes updated, remove what you do not use and protect every admin login with a personal account and multi-factor authentication. Serve every page over HTTPS with HSTS and sensible security headers, keep backups you have actually restored, protect your email domain with SPF, DKIM and DMARC, and publish a security.txt so people can warn you. Decide in advance who you call after a hack, because a personal data breach may have to be reported to the Autoriteit Persoonsgegevens within 72 hours. Free tools such as internet.nl show where to start, but they do not replace a security test of logins, forms and custom code.
How do you keep WordPress and other CMS software up to date?
Most attacks on small business websites are not personal. The NCSC describes software that scans websites across the internet and automatically tries to break in through known vulnerabilities, so even attackers with limited technical skills can cause real damage. An outdated plugin on a local bakery’s website is found in the same way as one on a large webshop.
The summer of 2026 showed how quickly this happens. On 21 July, the NCSC warned about two vulnerabilities in WordPress Core. The most serious one (CVSS score 9.8) allowed an attacker to run code remotely without logging in, and abuse was observed shortly after publication. Fixed versions included 6.8.6, 6.9.5 and 7.0.2. On 27 August 2026, the Autoriteit Persoonsgegevens (AP) said it was receiving many data breach notifications linked to these vulnerabilities and published advice for affected WordPress users.
The lesson is not specific to WordPress. Every CMS, plugin, theme and server component needs someone who installs security updates and checks that they worked.
Install security updates promptly
WordPress has supported automatic updates since version 3.7, and its hardening guide notes that older versions no longer receive security fixes. Turn on automatic minor and security updates where your setup allows it, and check the dashboard regularly for updates that need a manual step. For other systems, including custom applications, agree how quickly critical patches will be applied.
Remove plugins and themes you do not use
WordPress’s own hardening advice is simple: keep plugins updated and delete the ones you are not using. A deactivated plugin still sits on the server and can still contain vulnerable code. The same applies to old themes, test installations and forgotten subdomains. Fewer components mean fewer updates to track and fewer ways in.
Install software only from trusted sources
Download WordPress only from wordpress.org and choose plugins and themes from the official directory or well-known suppliers. Unofficial copies of paid plugins can contain hidden malware. The DISALLOW_FILE_EDIT setting in wp-config.php switches off the built-in code editor, which WordPress describes as often the first tool an attacker uses after logging in.
Put maintenance agreements in writing
The NCSC suggests asking your supplier when the latest security updates were installed, why any were skipped and how outdated plugins are handled. It also shares the story of a hospitality business whose webshop was offline for weeks after a vulnerability, because there were no clear agreements with the IT supplier about updates. If someone else maintains your website, record who updates what, how often and how you will be informed.
How do you secure admin accounts and logins?
A stolen or guessed password gives an attacker the same access as you. Most CMS and hosting accounts can be protected much better within an afternoon, and access management is one of the NCSC’s five basic principles for businesses.
Start with an inventory of every account that can change your website: CMS administrators and editors, the hosting control panel, the domain registrar and DNS, FTP or SSH access, analytics, and the business email accounts that can reset all of those passwords.
As of September 2026, the NCSC’s Mijn Cyberweerbare Zaak subsidy can cover half the cost of measures such as multi-factor authentication or a password manager for small businesses, up to €1,250. The FAQ below lists the conditions.
Personal accounts with only the rights people need
The NCSC advises giving people access only to the systems and information they need for their work, for as long as they need it, and avoiding shared accounts. In a CMS, that means an editor role for someone who writes news items and administrator rights only for the people who maintain the site. Personal accounts also make your logs meaningful, because you can see who changed what.
Strong, unique passwords in a password manager
Reused passwords are the main risk: when one service leaks, every account with the same password becomes vulnerable. A password manager makes long, unique passwords practical for the whole team. WordPress’s hardening guide also advises against passwords based on names, company names or dictionary words.
Multi-factor authentication on every important login
The NCSC recommends turning on two-step login for business applications, and in any case for business email. For your website, add the hosting account, the domain registrar and the CMS administrator accounts. Methods differ in strength: the NCSC notes that a code sent by email is easier to intercept than a fingerprint, and recommends choosing a method based on your risks.
Remove access when people or suppliers leave
Adjust rights when someone changes role and remove them when an employee, freelancer or former supplier leaves. The NCSC singles out the sudden departure of a system administrator as a moment that needs extra care. Deactivate service accounts you do not use, and clean up old integrations and API keys.
Which HTTPS and security header settings does a website need?
HTTPS encrypts the connection between a visitor’s browser and your server. It is the baseline, not the finish line. The NCSC points out that a secure connection says nothing about the content of a website: criminals use HTTPS on fake copies of real websites too. Security headers add instructions that tell browsers how to handle your pages.
HTTPS and certificates
Every page, image and form should load over HTTPS, and certificates should renew automatically. A free certificate such as Let’s Encrypt is fine for most websites; the NCSC notes that these certificates are valid for a short period, which makes automated renewal important. Outdated TLS settings can weaken an otherwise valid certificate. The NCSC maintains TLS security guidelines, and internet.nl checks websites and mail servers against them.
Redirects and HSTS
Redirect HTTP to HTTPS on the same host first, and only then to your preferred address. Mozilla’s HTTP Observatory explains that http://example.com should go to https://example.com before https://www.example.com, so that HSTS can be applied properly. The Strict-Transport-Security header then tells browsers to use HTTPS only; according to MDN, browsers also stop letting visitors click through certificate errors on that domain.
Start with a modest max-age and increase it once everything works. Preloading requires a max-age of at least 31,536,000 seconds (one year) and includeSubDomains, which covers every subdomain. Removal from the preload list is slow, so take that step only deliberately.
Content-Security-Policy
A Content-Security-Policy (CSP) tells the browser which scripts and other resources your pages may load. MDN describes it mainly as a defence against cross-site scripting (XSS); its frame-ancestors directive also protects against clickjacking. A strict policy can break analytics, chat widgets or embedded videos, so test it first with the Content-Security-Policy-Report-Only header, which reports violations without blocking anything.
Other headers worth checking
Internet.nl’s security options test looks at X-Frame-Options, X-Content-Type-Options, Content-Security-Policy and Referrer-Policy, as well as security.txt. Mozilla’s HTTP Observatory also flags insecure cookie settings. These settings usually live in your server, hosting panel or CDN configuration rather than in the CMS.
How should you back up your website?
A backup is your safety net when a hack, a failed update or a hosting problem destroys data. It only counts if you can restore it. For a website, that means the files (including uploads) and the database, plus a note of the configuration you need to rebuild the environment.
The NCSC recommends the 3-2-1 rule: at least three versions of your data (the original and two backups), on at least two different types of media, with one copy stored in a different location. Its basic principles add that backups should be disconnected from your production network, encrypted and dated, which reduces the chance of restoring an infected copy.
Retention matters as much as frequency. WordPress’s hardening guide gives the example of a site compromised on 1 May but not discovered until 12 May: with weekly snapshots kept long enough, the owner still has a clean copy from before the attack. If your host keeps only a few days of backups, a hack that is discovered late may already be in every copy.
We recommend testing a full restore at least once, ideally to a separate staging environment, and repeating it after major changes. Write down how long the restore took and what was missing. The NCSC also recommends practising recovery and periodically checking that backup data is still intact.
How do you stop others sending email in your name?
Your website domain is usually your email domain as well. Without the right DNS records, criminals can send phishing emails that appear to come from your business, which damages the trust of customers and suppliers. Three standards work together, and Forum Standaardisatie calls DMARC, SPF and DKIM an essential combination for secure email.
The internet.nl email test checks these records, together with secure transport (STARTTLS and DANE). It gives you a report link that you can share with your email provider.
SPF
SPF lists which mail servers may send email for your domain. Include every service that sends on your behalf, such as your mailbox provider, newsletter tool, CRM, webshop and the contact form on your website.
DKIM
DKIM adds a cryptographic signature to outgoing email. The receiving server checks it with a key published in your DNS, so it knows the message really came from your domain and was not changed in transit.
DMARC
DMARC tells receiving mail servers what to do when SPF or DKIM checks fail, and sends you reports about mail that uses your domain. The policy can be none (monitor only), quarantine (treat as suspicious) or reject. We recommend starting with none and reports, fixing your legitimate senders and then moving step by step towards quarantine and reject.
Domains you do not send email from
Parked and secondary domains can be abused as well. DMARC is on Forum Standaardisatie’s “apply or explain” list for the Dutch government, and must be applied to all government domain names, including those that do not send email. Internet.nl likewise notes that some email standards are relevant even when no mail servers are configured. The same logic works for a small business.
Which hosting, form and monitoring measures reduce risk?
Once the basics are in place, a few structural choices determine how much damage a single mistake can do. They are often made once, when a website is built or moved, and then forgotten. That makes them worth including in your website brief.
Choose hosting with clear responsibilities
The NCSC distinguishes between a CMS on your own server, a CMS on a hosting provider’s server and a SaaS platform. With your own server, you are responsible for everything, including critical patches; with SaaS, the provider handles technical maintenance. Whatever you choose, the NCSC advises putting these responsibilities in the contract. Ask your host about server updates, backups and how long they are kept, and how you will be informed about incidents.
Least privilege on the server and in integrations
Apply the same principle as for user accounts to the technical side. We recommend that the database user for your website can reach only its own database, that FTP or SSH access is limited to the people who need it, and that plugins and integrations get only the permissions they require. WordPress’s hardening guide calls this containment: configure the system so that a compromise does as little damage as possible.
A web application firewall
A web application firewall (WAF) filters malicious requests before they reach your application. WordPress mentions three places for one: a security plugin inside WordPress, a firewall on the web server such as the open-source ModSecurity, or a service between the internet and your hosting. A WAF buys time and blocks common attack patterns, but it does not replace updates. For websites flooded with traffic in a DDoS attack, the NCSC also points to filtering services such as a CDN.
Forms and spam protection
Contact and quote forms attract spam, and forms that accept uploads or send confirmation emails can be abused. Validate all input on the server, limit file types and sizes, and limit how many requests one visitor can send. CAPTCHA alternatives such as Cloudflare Turnstile check visitors with background signals instead of puzzles. Cloudflare stresses that the widget alone does not protect a form: your server must verify every token, and each token is valid for 300 seconds and can be used only once. Ask only for the fields you need; that reduces both spam and privacy risk.
Monitoring and logging
You cannot respond to what you do not notice. Use uptime monitoring and alerts for expiring certificates and, where your platform allows it, monitoring of changed and new files. WordPress recommends this because attacks leave traces in logs or on the file system. The NCSC warns that many systems do not log by default, that logs should be stored where an attacker cannot alter them, and that retention should balance investigation needs against privacy.
security.txt: make it easy to warn you
RFC 9116 describes a simple text file at /.well-known/security.txt, served over HTTPS, with at least a Contact field and an Expires field; the RFC recommends an expiry date less than a year ahead. The NCSC explains how to create one with securitytxt.org, check it with internet.nl and put the expiry date in your calendar. Make sure someone reads the mailbox and knows what to do with a report.
Which privacy rules apply when your website handles personal data?
Contact forms, customer accounts, newsletter sign-ups and analytics all involve personal data. The GDPR (in Dutch: AVG) requires appropriate technical and organisational measures to protect it. According to the AP, what is appropriate depends on a risk assessment: a medical file needs heavier protection than an email address. The AP also expects you to test regularly whether your measures are still effective.
Most small businesses fall outside the new Cyberbeveiligingswet (see the FAQ below), but the GDPR applies to every website that processes personal data.
Collect less, keep less
Data minimisation is one of the GDPR’s core principles: the AP explains that you may not process more personal data than necessary for your purpose. For a website, that means removing form fields you do not need, not storing form submissions in the CMS when they already arrive by email, and deleting old submissions, test exports and backups on a schedule. Data you do not hold cannot leak.
Report a data breach within 72 hours
A hack that exposes personal data can be a data breach. The AP states that you must report a notifiable breach within 72 hours after becoming aware of it. In a complex case such as ransomware, you submit a preliminary notification within that period and add details later. Weekends, holidays, illness and busy periods are not accepted as reasons for a late notification, and you may also have to inform the people affected without undue delay.
Keep a data breach register
The GDPR requires you to record every data breach in an internal register, including those you do not report to the AP: what happened, the consequences and the measures you took. The AP provides an example register you can use.
Website security checklist: 12 checks
Work through these checks with the person who maintains your website. For every unchecked item, write down one action, an owner and a date. Start with updates, multi-factor authentication and backups: they prevent or limit the most damage.
These checkmarks are temporary; your answers are not saved or sent. The checklist helps you review your website and does not guarantee that it is secure.
Which free tools can check your website security?
Several reputable tools check your website from the outside in a few minutes. They are a good way to find configuration gaps and to start a conversation with your hosting provider or developer. The Digital Trust Center’s guidance for businesses now lives on the NCSC website: as of September 2026, digitaltrustcenter.nl redirects to ncsc.nl, where you also find the basic principles and the CyberVeilig Check.
What free tools cannot tell you
The NCSC stresses that an internet.nl result is not a security test, although it gives useful information to discuss with your supplier. Mozilla is equally clear: an A+ in the HTTP Observatory does not mean a site is secure, because it does not test for outdated software, vulnerable CMS plugins, SQL injection or how passwords are stored. External scans also cannot see behind a login, check whether one customer can view another customer’s data or judge the logic of a quote or payment flow.
When is a penetration test appropriate?
In a penetration test, specialists actively try to exploit vulnerabilities, with your written permission and an agreed scope. The NCSC recommends having a website examined periodically by an independent external party, at least once a year, and including web services and APIs in the scope. We recommend a test in particular when your website has customer accounts, handles payments or sensitive data, runs custom code or an API, or has just been rebuilt. Our penetration test guide explains how the process works and how to prepare.
| Tool | What it checks | Who it is for | Keep in mind |
|---|---|---|---|
| Internet.nl | Website test: IPv6, DNSSEC, HTTPS against the NCSC TLS guidelines, security headers, security.txt and RPKI. Email test: SPF, DKIM, DMARC, STARTTLS and DANE. | Every business with its own domain; the report link is easy to share with your host | An initiative of the Dutch Internet Standards Platform. The NCSC notes that it is not a security test. |
| Mozilla HTTP Observatory | HTTP security headers, redirects, cookie settings and related browser protections | Developers and technically minded owners | The scan history of each domain is public. No TLS details and no check of outdated software or plugins. |
| Qualys SSL Labs SSL Server Test | A detailed analysis of the certificate and TLS configuration of a public web server | Whoever manages the server, hosting or CDN | Tick “Do not show the results on the boards” to keep your result off the public lists. |
| NCSC CyberVeilig Check | A self-assessment of basic security for small organisations, with a personal action list | Owners of small businesses and self-employed professionals | Takes about five minutes and covers the whole business, not only the website. In Dutch. |
| NCSC five basic principles | Practical measures for risks, safe behaviour, protecting systems, access and incidents | Business owners planning their basic security | Guidance rather than a scan; the former Digital Trust Center advice is published here. |
What should you do if your website has been hacked?
Signs of a hack include unknown admin accounts, pages or redirects you did not create, spam sent from your domain, a warning in search results or a hosting provider suspending your account. Act quickly, but in a fixed order. The NCSC recommends preparing an incident response plan and a printed call list with your hosting provider, developer and other suppliers, because you may not be able to open your digital files when your systems are down.
1. Get an overview and keep a log
Write down what you noticed, when, and every action you take. The NCSC recommends an incident log because it helps you find the cause and supports a police report or an insurance claim. The AP’s first step for a data breach is the same: establish what happened, since when and which data is involved.
2. Contain the damage
Involve your hosting provider or developer early. Put the website into maintenance mode or take it offline if it spreads malware or leaks data, block compromised accounts and change the passwords for the CMS, hosting, database and email. The NCSC also advises enabling two-factor authentication wherever possible at this point.
3. Preserve evidence and backups
Secure copies of logs and existing backups before you wipe anything, as logs may be needed for forensic research. Keep in mind that recent backups may already contain the malicious code. For complex incidents, the AP advises bringing in an expert, such as a digital forensic specialist.
4. Assess personal data and report within 72 hours
If personal data may have been accessed, assess the risk and report a notifiable breach to the AP within 72 hours after becoming aware of it. In its August 2026 advice to WordPress users, the AP said that if you cannot rule out access to personal data, you should assume the worst case, and that large numbers of exposed email addresses and phone numbers call for informing everyone affected as soon as possible. Record the breach in your register either way.
5. File a police report
The NCSC advises always reporting cybercrime to the police and keeping evidence unchanged. Organisations can file online with eHerkenning, and self-employed people with DigiD. Report phishing sent in your name to the Fraudehelpdesk as well.
6. Restore, fix the cause and learn
Rebuild from a clean backup or a fresh installation, apply all updates, remove unknown accounts and plugins, and fix the weakness that let the attacker in; otherwise the same hole will be used again. Afterwards, update your checklist and incident plan with what you learned.
A practical next step
Pick three open items from the checklist and assign them this week. Run internet.nl for your website and email domain, and share the report links with your hosting provider or developer. If your website processes customer data or runs custom code, plan a deeper test.
Would you like a second pair of eyes first? Our free AI visibility & security scan reviews one website from the outside: HTTPS and certificates, security headers, SPF and DMARC, and technical details you may not mean to share, alongside how search engines and AI tools understand your business. The scan is passive and without obligation; it is not a penetration test. Pixel Dev can then help you fix what we find, harden hosting and deployment pipelines, or scope a web or API penetration test.
Frequently asked questions
How can I prevent my website from being hacked?
No measure makes a website unhackable, but many attacks on small business websites use known weaknesses: outdated software, reused passwords and missing multi-factor authentication. Keep everything updated, remove unused plugins, protect every admin login with MFA and limit who has which rights. Tested backups and monitoring do not prevent a hack, but they make recovery much faster.
How do I secure a WordPress website?
Keep WordPress core, plugins and themes updated, delete what you do not use and install software only from wordpress.org or well-known suppliers. Give every user a personal account with the lowest role that works, turn on multi-factor authentication for administrators and consider switching off the built-in file editor. Follow NCSC alerts as well: in July 2026, it warned about serious, actively exploited vulnerabilities in WordPress Core.
Is an SSL certificate enough to make my website secure?
No. A certificate enables HTTPS, which protects the connection between the browser and your server. It does not protect against outdated plugins, weak passwords or a vulnerable form, and the NCSC notes that fake websites use secure connections too. Treat HTTPS as one item on the checklist, not the whole list.
Do I have to report a hacked website to the Autoriteit Persoonsgegevens?
Only if personal data is involved and the breach is notifiable, but many hacks do involve personal data, such as form submissions or customer accounts. The AP requires notification within 72 hours after you become aware of the breach, and a preliminary notification is possible while you investigate. Every breach, reported or not, belongs in your internal data breach register.
How often should a small business test its website security?
We recommend running free tools such as internet.nl after every significant change and at least a few times a year. For a deeper review, the NCSC recommends an independent external test at least once a year, with the scope agreed in advance. How deep that test should go depends on what your website does and which data it processes.
Does the Cyberbeveiligingswet (NIS2) apply to my small business?
Probably not directly. According to the NCSC, the Dutch Cyberbeveiligingswet has been in force since 15 August 2026 and applies to around 8,000 organisations in eighteen critical sectors that have 50 or more employees, or both an annual turnover and a balance sheet total above €10 million; some types of organisation are covered regardless of size. Customers that fall under the law may, however, set security requirements for their direct suppliers.
Is there a subsidy for cyber security measures for small businesses?
Yes, as of September 2026. Through the Mijn Cyberweerbare Zaak scheme, businesses with up to 50 employees and up to €10 million in annual turnover can apply until 30 November 2026 for 50% of the cost of measures such as multi-factor authentication, a password manager, patch management or setting up and testing backups, with a maximum of €1,250. Applications are handled in order of receipt until the €1 million budget runs out, so check the NCSC page for the current status.
