Small Business Website Security Checklist for Singapore

A small business website is rarely just a brochure. It often holds a contact form, customer enquiries, a login page or an online shop, so a weak setup can mean real disruption.

Before year-end campaigns bring more visitors, it helps to run a short security check. This checklist covers routine tasks that a business owner or part-time site manager can handle: updates, logins, backups, encryption and incident preparation. It is educational guidance, not a security audit or legal advice.

Start with a free baseline check

The Cyber Security Agency of Singapore (CSA) lists a Cybersecurity Health Check Tool and an Internet Hygiene Portal on its website. Open the tool's page to see what it covers and whether it suits your business, then use the results to decide which checks below to tackle first.

CSA also lists a password checker. Read the page first so you understand how it works before using it.

Ten checks to run before your busy season

Work through these in order. Each takes only minutes to check, although fixing a gap may take longer. The WordPress items follow the official WordPress hardening guide.

Keep software current

1. Update WordPress core, plugins and themes. The WordPress guide advises always running the latest version, because older versions no longer receive security fixes. Minor and security releases can install automatically on supported sites, but whether major releases update automatically depends on how your site was installed and on your hosting settings. Check your update configuration (see the WordPress upgrading guide) and apply any pending update yourself.
2. Remove what you do not use. Delete inactive plugins and themes you no longer need, but keep any parent theme that an active child theme relies on. Remove only components that are genuinely unused. Install extensions only from the WordPress.org repository or well-known vendors, never from untrusted sources.
3. Back up before every update. WordPress's update documentation recommends a backup first, so you can restore the site if something breaks.

Secure every login

4. Use strong, unique passwords. Avoid numeric-only or letters-only passwords. A password manager makes unique passwords practical for a whole team.
5. Turn on two-step authentication. The WordPress guide calls it a good additional measure. Enable it at least for administrator accounts.
6. Avoid predictable usernames and limit admin accounts. The guide advises against names like admin or webmaster. Give each staff member their own account with only the access they need.

Protect the connection and the server

7. Use an SSL certificate and serve the site over HTTPS. SSL encrypts the connection between your visitors and your site. It matters most wherever people log in or submit forms.
8. Lock down file permissions. The guide recommends restricting permissions as much as possible and avoiding the built-in theme and plugin editor where you can.

Be ready to recover

9. Keep dated backups of files and the database. The guide recommends regular backups kept in a trusted location, so older copies remain available if a problem is found late. Test a restore at least once.
10. Write a one-page incident plan. Note who manages the site, how to reach your hosting provider and where backups are stored. CSA's SingCERT has a page for reporting a cybersecurity incident.

If you only have one hour

Not every business has time for a full review. If you can spare only an hour, spend it in this order, because each step protects the one after it.

1. Take a full backup of your files and database, and confirm you can download it.
2. Apply pending updates to WordPress core, plugins and themes, then browse your key pages to confirm they still work.
3. Review your user list, remove anyone who no longer needs access, and enable two-step authentication on the remaining admin accounts.

Once these are done, schedule the remaining checks in your calendar rather than leaving them for later.

A realistic example

Imagine a small online seller preparing a year-end sale. The site runs WordPress with a dozen plugins, and three of them have not been opened in months. A sensible order of work would be: take a backup, update the plugins that are still needed, delete the three unused ones, give a part-time assistant a limited role instead of the shared admin password, and confirm the checkout pages load over HTTPS.

None of these steps needs a specialist, and together they remove several common weak points before traffic increases. This is an illustration, not a case study.

A simple maintenance routine

Security is easier when it becomes a habit. These frequencies are suggestions, so adjust them to how often your site changes.

Common mistakes to avoid

What to look for in a hosting plan

Your hosting plan can take on part of the work, but features differ by plan, so compare before you choose. On the Z.com Singapore web hosting page, the paid plans list free SSL, free automated backups and Imunify 360, while the Free plan does not list backups.

The WordPress Hosting page lists items such as a web application firewall, login attempt limits and directory or IP access restrictions, with a comparison table for the detail. Check which plan includes each item, and confirm how backup restores work, before you rely on them.

Frequently asked questions