Website security basics for Singapore SMEs: the few things that stop most attacks

Many owners assume nobody would bother attacking a small website. In practice, most attacks are automated: software scans thousands of sites for known weak spots and breaks into whichever ones are open. Small sites get hit because they are often easy. The good news is that a handful of basics prevents most of it.

Why it matters for your business

A hacked site can leak customer details, send spam in your name, get flagged or blocked by Google and damage trust. In Singapore, organisations also have a duty under the PDPA to take reasonable steps to protect the personal data they hold. This is not legal advice, but it is a good reason to take the basics seriously.

The basics

1. Keep everything updated. Your website platform, themes and plug-ins are the most common way in. Remove any you no longer use.
2. Use strong, unique passwords and turn on multi-factor authentication for admin logins, hosting and your domain account.
3. Limit who has admin access, and remove old accounts when people leave.
4. Use HTTPS on every page and add basic security headers.
5. Back up automatically, and test that a restore works. A backup you have never restored is a hope, not a plan.
6. Protect your forms from spam and bots so they cannot be used as a way in or a spam relay.
7. Set up email authentication (SPF, DKIM and DMARC) so criminals cannot easily send emails pretending to be you.

Keep an eye on it

Security is not a one-off job. Check for updates regularly, review who has access and watch for signs that something is wrong: unexpected pages, redirects to other sites, warnings in Google Search Console or customers reporting odd emails from you.

If you think you have been hacked

1. Change the passwords for your website, hosting, domain and email.
2. Take the site offline or put it in maintenance mode if customers could be harmed.
3. Restore from a clean backup if you have one.
4. Update everything and remove anything you do not recognise.
5. Check whether personal data may have been exposed and seek advice on your obligations.

If you would like to know where your site stands, we run a security scan and explain every finding in plain English.