The security work you only notice when it's missing

Website security for a small business is mostly about the automated majority: attack traffic filtered before it reaches a page, forms protected without punishing customers, mail that can't be forged, and backups that have actually been restored once. None of it is visible when it's working, which is why it's the first thing cut.

Is anyone really attacking a small business site?

Not personally, and that's the point. Login pages get tried, forms get flooded, known weaknesses get probed — thousands of times a day, automatically, on sites nobody has heard of. It isn't dramatic; it's ambient. Most of what lands isn't a targeted attack, it's an unpatched thing a scanner found.

And the most expensive failure we see isn't a breach at all. It's a contact form with no protection collecting 200 spam messages a week, until the owner stops reading the inbox and misses two real enquiries. That's not a security incident. It cost more than most security incidents do.

Why no CAPTCHA?

Because the picture puzzles stop your customers about as effectively as they stop bots, and a meaningful share of people simply give up. You bought spam protection and paid for it in lost enquiries.

What works instead is invisible: a form field hidden from people and irresistible to bots — anything that fills it in is a bot — plus a silent challenge running underneath. Your customers see a normal form.

What's actually in the security work?

• Rate limits enforced on the server, not in the browser. A limit enforced in the browser is decoration; an attacker isn't using your browser.
• Security headers — forcing encryption, stopping your site being framed by someone else, stopping browsers guessing at file types, controlling what leaks in a referrer. Checked on the live response, because "configured" and "working" are different claims.
• Email authentication. Three DNS records that together stop anyone sending mail pretending to be you — and stop your own mail landing in spam folders. This is the mechanism behind most invoice-fraud emails that appear to come from a company, and its absence is close to universal.
• A firewall in front of the site, denial-of-service protection, and bot management (Growth and above).
• Your domain locked against transfer, with a record naming who may issue certificates for it. Those two turn a compromised email account from a stolen website into an inconvenience.
• Daily backups with a restore actually performed once. An untested backup is a rumour.

The trap that makes you invisible to ChatGPT

This one deserves its own section, because it's the most common expensive mistake in the whole category.

Turning on aggressive bot protection is the single most common way a website becomes invisible to AI assistants. Bot rules can't tell a scraper from an AI crawler unless someone configures the difference. Nothing visible changes — the site looks fine, the security dashboard looks great — and you quietly stop existing to ChatGPT, Perplexity and Claude.

The discipline is simple and almost nobody does it: every time bot rules change, re-run the crawler access test. If a vendor turned on security for you and nobody re-tested this afterwards, it's worth checking today.

Common questions

Does this make me unhackable?

No, and anyone telling you a package does is selling something. It removes the automated majority and makes the remainder recoverable — which, for a small business, is the whole realistic goal.

What if my site has already been compromised?

On any site we didn't build, we check for that before taking it on — inheriting a hacked site silently makes it ours. If it's already compromised you'll hear that before you pay, not after.

I sell online. Is there anything extra?

Yes, and it's not optional. Since March 2025 the card industry has required that every script on a payment page be authorised and inventoried, and that unexpected changes be detected. Card details are now stolen by a script injected into a checkout page, not by a break-in. We won't ship a store without those controls.