--- title: 'Secure Small Business Web Hosting: What to Look For' url: 'https://triplepoint.org.uk/guides/secure-web-hosting-small-business' markdown: 'https://triplepoint.org.uk/guides/secure-web-hosting-small-business.md' date: '2026-10-28' description: 'Choosing web hosting for a small business site? The security features that matter, from backups to updates and SSL, and the questions to ask any host.' --- # Secure Small Business Web Hosting: What to Look For ![](https://triplepoint.org.uk/user/pages/guides/secure-web-hosting-small-business/secure-web-hosting-small-business.jpg) **Secure web hosting for a small business should include automatic security updates for the server and your website software, daily backups stored away from the server, HTTPS on every page, protection against common attacks, multi-factor authentication on admin logins, and someone watching for problems.** Just as important is knowing who is responsible for each of those. With basic hosting, the host looks after the server and updating your website is down to you, so it often doesn't happen. ## Why small business websites get hacked Most small business websites are hacked by automated tools, not by someone who chose them. Bots scan the internet constantly for websites running software with known weaknesses, and break into whichever ones they find. For WordPress, which runs a large share of small business sites, security company Patchstack's [State of WordPress Security in 2026](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) report found **11,334 new vulnerabilities in 2025, a 42% increase on 2024, with 91% of them in plugins**. It also found that around half of high-impact vulnerabilities are exploited within 24 hours. So the biggest risk to most sites isn't the hosting itself: it's plugins and themes that nobody updates. ## What a hacked website costs you - **Your visitors' safety.** Hacked sites are used to spread malware or redirect visitors to scams. - **Your search rankings.** Google and browsers warn visitors away from sites flagged as dangerous. - **Your email.** If your email runs from the same server, it can end up on spam blocklists. - **Personal data.** If your site has forms or a shop, a breach may need [reporting to the ICO](https://triplepoint.org.uk/guides/report-a-cyber-attack-uk). - **Time and money** to clean it up, which is often more than years of good hosting would have cost. ## The security features that matter 1. **Updates for everything,** not just the server: the operating system, the web server, PHP and your website's own software, plugins and themes. Ask who does each. 2. **Daily backups, stored off the server,** kept for several weeks, and restored as a test now and then. A backup on the same server can be lost or encrypted along with it. 3. **HTTPS on every page,** with a certificate that renews automatically. 4. **A web application firewall,** which blocks common attacks and bad bots before they reach your site. 5. **Multi-factor authentication** on the hosting control panel and your website's admin login, and no shared admin accounts. 6. **Each site kept separate,** so a problem on one website on the server can't spread to yours. 7. **Monitoring,** for downtime, malware and unexpected changes, by someone who acts on it. 8. **UK data centres,** if your site collects personal data. 9. **Support you can reach,** from people who know your setup, especially on the day something goes wrong. If your email is hosted too, make sure SPF, DKIM and DMARC are set up for your domain, so criminals can't easily send emails that appear to come from you. ## Basic vs managed hosting | | Basic hosting | Managed hosting | |---|---|---| | **Server updates** | The host | The host | | **Website, plugin and theme updates** | You, or your web designer | The host | | **Backups** | Sometimes, often on the same server | Included, stored separately | | **Monitoring** | Usually uptime only | Uptime, security and changes | | **If the site is hacked** | Usually your problem | The host helps clean it up | | **Best for** | Businesses with someone technical to look after the site | Businesses that want it handled | ## Questions to ask any host - Who updates the website software, plugins and themes, and how often? - How often do you back up, where are the backups kept, and how long for? When did you last test a restore? - What happens, and what does it cost, if my site is hacked? - Where are your servers? - Is multi-factor authentication available on the control panel? - Who do I talk to when something goes wrong, and how quickly will they respond? - If I leave, how do I get a full copy of my site and email? Vague answers to any of these are worth taking seriously. ## Where we can help Our [web hosting](https://triplepoint.org.uk/hosting) is for small businesses, charities and community groups that want a secure site without thinking about the technical side. Backups, monitoring and security hardening are included as standard, with direct support from our Oxfordshire team and pricing agreed up front. Because security is our other business, we look after hosting the same way. [Talk to us](https://triplepoint.org.uk/contact?about=Hosting) about your website. ## Questions Does it matter if my website is hosted in the UK?+If the site collects personal data, such as through a contact or booking form, UK hosting keeps that data under UK law and avoids the extra checks needed when data goes overseas. Hosting close to your visitors can also make the site a little faster. Is a free SSL certificate good enough?+Yes. Free certificates, such as those from Let's Encrypt, encrypt traffic just as well as paid ones. What matters is that the certificate renews automatically and every page loads over HTTPS. How often should a website be backed up?+At least daily for a site that changes often, such as one taking orders or bookings, and weekly for a simple brochure site. Keep several weeks of backups, stored away from the server itself, and test a restore now and then. My web designer looks after the site. Do I need to worry?+Check exactly what they've agreed to do. Many build a site and hand it over, and nobody updates the plugins after that. Ask who applies updates, how often, and who you call if the site is hacked. Where to go next- [Secure UK web hosting](https://triplepoint.org.uk/hosting) - [Vulnerability management](https://triplepoint.org.uk/security/risk-and-assurance/vulnerability-management) - [Email security](https://triplepoint.org.uk/security/people-and-email/email-security) - [Vulnerability scan vs penetration test](https://triplepoint.org.uk/guides/vulnerability-scan-vs-penetration-test) [< Back to Guides](https://triplepoint.org.uk/guides) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md) - Previous: [Staff Phones and Work Email: BYOD Security](https://triplepoint.org.uk/guides/secure-staff-mobile-phones-byod.md) - Next: [Vulnerability Scan vs Penetration Test](https://triplepoint.org.uk/guides/vulnerability-scan-vs-penetration-test.md)