How to protect your website from hackers: a practical guide for Canadian small businesses

A plumber in Cambridge, a salon in Mississauga, or a bookkeeping firm in Halifax does not feel like a hacking target. The business is small, the website is simple, and there is nothing obviously worth stealing. That is exactly why small business websites get attacked so often. Attackers do not sit down and pick your business out of a list. They run automated tools that scan thousands of websites a day, looking for the same few weaknesses: an old plugin, a weak password, an unprotected login page, or a site with no backup to restore from. If your site has one of those weaknesses, the scan finds it, and the attack happens whether or not anyone has ever heard of your business.

Learning how to protect your website from hackers does not require technical skill, and it does not require expensive security software. It requires a short list of habits, done consistently, plus a plan for what to do on the day something goes wrong. This guide covers that list in order of impact, with the Canadian details that matter: privacy rules, domain and hosting choices, and the scams that target Canadian business owners through their inbox as often as through their website.

The short answer

To protect your website from hackers, do these ten things: use HTTPS on every page, keep your platform, theme, and plugins updated, delete anything you do not use, use long unique passwords stored in a password manager, turn on two-factor authentication for every account that touches your site, give each person only the access they need, keep automatic backups stored away from your server and test that you can restore one, use a firewall and malware scanning, choose hosting that patches and isolates your site properly, and check on the site regularly. None of these steps is difficult on its own. Together, they close the doors that automated attacks actually try.

There is no single product that makes a website unhackable, and anyone selling one is overselling. Security is layers. If one layer fails, the next one should catch the problem or limit the damage. A strong password helps, but two-factor authentication matters when a password leaks. Updates matter, but a backup matters when an update is missed and something gets in. Think of this guide as building those layers one at a time, starting with the ones that cost nothing.

Why small business sites get targeted

Most website attacks are opportunistic, not personal. A bot scans the internet for sites running a known, outdated version of a popular platform or plugin. When it finds one, it tries a known exploit for that version. It does not care whether the site belongs to a multinational or a one-person shop in Ontario. In fact, small sites are often easier targets, because they are updated less often, they share a login password across several accounts, and nobody is watching the site day to day.

The damage is rarely dramatic in the way movies suggest. More often, an attacker quietly adds spam links to your pages, redirects your visitors to a scam site, uses your site to send spam email, or replaces your homepage with a defaced message. Sometimes the damage is invisible to you but visible to Google, which may flag your site as dangerous and remove it from search results until the problem is fixed and reviewed. That is when a hacked site starts costing real money: customers cannot find you, existing customers lose trust, and you spend days cleaning up instead of doing the work you are paid for.

There is a second kind of attack that does not touch your website code at all. It targets you, the owner, through email and phone. Phishing messages that copy your hosting company, your bank, or your payment provider ask you to log in through a fake link. Fake domain renewal notices warn that your domain will expire unless you pay a company that is not your registrar. Fake invoices arrive for services you never ordered. These scams work because they arrive during a busy week and look routine. The rule that stops most of them is simple: never log in through a link in an email. Go to the provider's site directly, or call a number you already have.

Step 1: Use HTTPS on every page

HTTPS encrypts the connection between your visitor's browser and your website, so passwords, form submissions, and other data cannot be read or altered in transit. It also shows the padlock in the browser, which visitors now expect. A site still served over plain HTTP looks unfinished, and browsers warn visitors about it.

Most reputable hosts include a free SSL certificate and will set it up for you. If your site is still on HTTP, ask your host or developer to install a certificate and redirect every page to the HTTPS version, not just the homepage. Check the redirect yourself: type the old http address into a browser and confirm it lands on the https version. Also check that images, scripts, and other page resources load over HTTPS, because a single insecure element can trigger a mixed-content warning. This step costs nothing with most hosts and takes minutes to arrange, which is why it comes first.

Step 2: Keep everything updated, and remove what you do not use

Outdated software is the most common way small business sites get compromised. Platforms like WordPress, themes, and plugins receive security fixes regularly, and attackers know exactly which old versions have known flaws. When a security update is released, the flaw becomes public knowledge, and bots start scanning for sites that have not applied it yet. Updating promptly closes that window.

Turn on automatic updates where your platform offers them, especially for minor security releases. For larger updates, apply them within days, not months, and check the site afterwards to confirm nothing broke. If you are nervous about updates breaking a custom feature, that is a reason to have a backup and a staging copy, not a reason to leave a known flaw in place for a year.

Just as important is removing what you do not use. Every unused plugin, theme, and old admin account is a potential weakness that nobody is watching. Delete unused plugins and themes rather than just deactivating them, because deactivated code can still be reached in some setups. Delete old user accounts for former staff, former developers, and anyone who no longer needs access. A tidy site is easier to update, easier to back up, and harder to break into. Our guide to website maintenance costs in Canada explains what a regular maintenance routine typically includes and what it tends to cost, so you can decide whether to handle updates yourself or hand them to someone else.

Step 3: Strong, unique passwords and a password manager

Passwords are still the front door of most small business websites, and reused passwords are the reason that front door so often stands open. If you use the same password for your website admin, your hosting account, your domain registrar, and your email, then a leak from any one of those services hands an attacker the keys to all of them.

Use a long, unique password for every account. A passphrase of four or five random words is both strong and memorable, and a password manager makes unique passwords practical: it creates them, stores them, and fills them in for you, so you only need to remember one strong master password. Start with the four accounts that matter most, because they control everything else: your domain registrar, your hosting account, your website admin, and your business email. Change any password that you know has been reused, and never share a single admin login between several people. Each person should have their own account, so access can be removed for one person without disrupting everyone else.

Step 4: Turn on two-factor authentication everywhere it is offered

Two-factor authentication, often called 2FA, asks for a second proof of identity after your password, usually a code from an authenticator app on your phone. Even if a password leaks or is guessed, an attacker cannot log in without that second factor. It is the single most effective step on this list relative to the effort involved, and it takes only a few minutes per account.

Turn it on for your hosting account, your domain registrar, your website admin, and your business email, in that order if you are doing it in stages. Prefer an authenticator app over text message codes where you have the choice, because text messages are easier to intercept than an app code. Store your backup codes somewhere safe, such as a printed copy in a locked drawer, so you are not locked out if you lose your phone. If a service that holds your website or domain does not offer two-factor authentication at all, that is worth weighing when you next choose a provider.

Step 5: Give people only the access they need

Not everyone who works on your website needs full admin access. A writer who publishes blog posts needs an editor role, not the ability to install plugins or change site settings. A contractor who updates photos for one week needs access for that week, not forever. Every admin account is another door, so keep the number of admin accounts small and review the user list every few months.

When someone leaves, whether an employee, a contractor, or a developer, remove or downgrade their access the same week. This is the step businesses most often forget, and it is one of the easiest for an attacker or a disgruntled former contact to exploit. Keep a short written list of who has access to what: domain, hosting, website admin, analytics, email, and social accounts. That list also saves you a frantic search on the day you need to change a password quickly.

Step 6: Back up automatically, and test the restore

A backup is your way back from almost every bad day: a hack, a bad update, a hosting failure, or an accidental deletion. Without one, a hacked site becomes a rebuild. With one, it becomes a bad afternoon. Set up automatic backups, daily for a site that changes often, weekly at minimum for a mostly static brochure site, and store at least one copy away from your web server, such as with your host's separate backup system or a cloud storage account you control.

The part most owners skip is testing the restore. A backup you have never restored is a hope, not a plan. Once a quarter, ask your host or developer to restore a backup to a test location and confirm the site actually works: pages load, forms submit, and no content is missing. Write down where backups live, how far back they go, and who knows how to restore one. If you are the only person who knows, that knowledge leaves with you on holiday, so share it with at least one other trusted person or with your maintenance provider.

Step 7: Use a firewall and malware scanning

A web application firewall filters malicious traffic before it reaches your website: automated login attempts, known exploit patterns, and requests that match common attack signatures. Many hosts include a basic firewall, and there are reputable security plugins for platforms like WordPress that add one. A firewall does not replace updates or strong passwords, but it buys time by blocking the noisiest automated attacks before they reach your code.

Pair the firewall with scheduled malware scanning. A scan checks your site files for code that should not be there, and alerts you early, while the damage is still small. Check what your host already provides before buying a separate tool, because paying twice for the same scanning is a common waste. If a scan flags something, do not ignore it and do not just delete the flagged file without understanding how it got there, because the entry point is usually still open and the problem will return. Note the alert, preserve a copy of the report if you can, and get help closing the entry point as well as removing the malware.

Step 8: Choose hosting that does security work for you

Your host handles a layer of security you cannot see: patching the server, isolating your site from other sites on the same server, and responding when something goes wrong. Cheap, unmanaged hosting often leaves all of that to you, which is fine if you have the skill and time, and a problem if you do not. When choosing a host, ask four questions: does the plan include malware scanning, a firewall, and free SSL? Are automatic backups included, and how far back do they go? Is your site isolated from other accounts on shared hosting, so a compromised neighbour cannot reach your files? And can support help if the site is hacked, or will they only point you to a forum?

Canadian owners have one extra consideration. If your site collects customer information, hosting your data in Canada can simplify your privacy story, because the data stays under Canadian privacy law rather than being subject to another country's access rules as well. It does not, on its own, make you compliant with privacy law, and it does not replace the steps in this guide, but it is worth asking about. Our guide to web hosting costs in Canada covers Canadian hosting options, data centre locations, and the intro-price trap to watch for when comparing plans.

Step 9: Protect your forms and your domain

Contact forms are a frequent target because they are public and they send email. An unprotected form can be abused to send spam in your name, which can damage your domain's email reputation and get your messages filtered as spam. Use a form tool with spam filtering and validation, such as a CAPTCHA or a honeypot field, and make sure the form handler does not expose your email address in the page source. If your form suddenly starts delivering hundreds of spam messages, treat it as a security signal, not just an annoyance, and tighten the filtering before your domain reputation suffers further.

Your domain deserves the same care as your website. Turn on registrar lock if your registrar offers it, so the domain cannot be transferred without your approval. Keep the contact email on the domain registration current and secured with two-factor authentication, because a password reset for your domain account usually goes to that email. Be suspicious of renewal notices from companies you do not recognize, especially ones that charge far more than your registrar or warn of urgent expiry. Check the sender, check the domain name in the notice, and renew only through your own registrar's site. Losing control of a domain can take a business offline more completely than a hacked page, because visitors cannot even reach the site.

Step 10: Watch the site, and keep a simple routine

Security fails quietly. A site can be compromised for weeks before anyone notices, because the attacker wants it to keep working while it sends spam or hosts hidden links. Set up uptime monitoring, which many hosts and free tools provide, so you are alerted if the site goes down. Check Google Search Console for security issues and indexing warnings, and glance at your site's login activity and file changes if your platform shows them. You do not need to watch daily. A monthly check is enough for most small sites, as long as it actually happens.

Put the routine on a calendar, not in your head. Once a month: apply any pending updates, review the user list, confirm the latest backup exists, and check Search Console for warnings. Once a quarter: test a restore, review who has access, and renew or review any security tools you pay for. Once a year: review your domain registration and hosting plan, confirm your registrar lock and two-factor authentication are still on, and update the one-page incident plan described below. A routine that small is the difference between a site that stays protected and a site that was protected once, two years ago.

Canadian privacy rules: what a hack means for your customers

If your website collects personal information, such as names, email addresses, phone numbers, or payment details through a form, a booking system, or a store, a hack is not only a technical problem. It can also be a privacy incident. Under Canada's federal privacy law, PIPEDA, businesses must report a breach of security safeguards to the Privacy Commissioner of Canada and notify affected individuals where there is a real risk of significant harm, such as financial loss, identity theft, or damage to reputation. Some provinces have their own privacy laws and breach rules, and Quebec's Law 25 has its own notification requirements, so the exact obligations depend on where you operate and whose information was involved.

You do not need to become a privacy lawyer to handle this well. You need three things ready before an incident: a record of what personal information your site collects and where it is stored, a contact for privacy advice (your lawyer, your industry association, or the Privacy Commissioner's guidance for businesses), and a clear internal step that says who decides whether to report and notify. If you are unsure whether an incident meets the reporting threshold, get advice promptly rather than waiting, because delay makes both the privacy problem and the customer trust problem worse. Keep your customer communication honest and specific: what happened, what information was involved, what you have done, and what customers should do. Customers forgive a business that tells them plainly far more readily than one they hear about from someone else.

Reducing what you collect is also a security step. If your contact form does not need a date of birth, do not ask for it. If you no longer need old enquiry records, delete them under a simple retention rule. Less stored personal information means less to protect, less to lose, and a smaller incident if something does go wrong. The Canadian Centre for Cyber Security publishes plain-language guidance for small and medium businesses, and it is a useful, free reference to keep alongside this guide.

What to do if your website is hacked

If you discover your site has been hacked, work through these steps in order, and do not panic-delete everything before you understand what happened.

• Do not pay a ransom or a stranger who offers to fix it for a fee. Contact your host or your developer first, through a number or address you already have, not through a link in a suspicious message.
• Change the passwords. Website admin, hosting, database if you have separate credentials, domain registrar, and business email, in that order, and turn on two-factor authentication anywhere it is missing.
• Take the site offline or into maintenance mode if you can. This stops visitors from reaching malicious content and stops the attacker from using the site while you work.
• Find the entry point, then clean up. Restore from a clean backup made before the hack, or have the malware properly removed. Removing the visible damage without closing the entry point, such as an outdated plugin or a compromised account, usually means the site gets hacked again within days.
• Check for hidden damage. Look for new admin users, unfamiliar files, changed redirects, and spam links on pages that look normal at first glance. Check Google Search Console for security warnings.
• Assess the privacy question. Work out whether personal information was accessed, and get advice on whether you need to report to the Privacy Commissioner and notify affected people, as described above.
• Ask Google for a review once the site is clean. If Google flagged the site, Search Console lets you request a review after cleanup. Fix everything first, because a review request on a still-infected site wastes time.
• Close the gap that let the attacker in. Update the software, remove the unused plugin, revoke the compromised account, or tighten the form filtering, whichever the evidence points to, and write down what changed so the same gap does not reopen.

If the hack involved customer payment data, contact your payment provider immediately as well, because they will have their own required steps and may need to involve their fraud team. If you are unsure at any step, getting professional help early is cheaper than a second cleanup. A rushed, partial cleanup that leaves the entry point open is the most common reason hacked sites get hacked twice.

A starter checklist you can finish this week

If the full guide feels like a lot, start with the highest-impact work in one focused session:

• Turn on two-factor authentication for your hosting, domain registrar, website admin, and business email.
• Change reused passwords to long, unique ones, and put them in a password manager.
• Update everything and delete unused plugins, themes, and old user accounts.
• Confirm HTTPS on every page, with all pages redirecting to the secure version.
• Confirm your latest backup exists and that a copy is stored away from your server.
• Check Google Search Console for security issues, and set up uptime monitoring if you do not have it.
• Write the one-page incident plan: who to call, where backups live, who can change passwords, and who decides on privacy reporting.

That is a realistic afternoon of work, and it covers the foundation every later security tool depends on. Repeat the monthly checks, keep the software updated, and revisit the plan once a year or whenever you change hosts, developers, or platforms.

How Webloped fits in

We are a web design and AI automation company based in Cambridge, Ontario. Every site we build starts with the security foundation in this guide: HTTPS throughout, clean structure, up-to-date software, limited admin access, and backups and monitoring arranged from day one, so the basics are not left for later. Our services page outlines what we do, and our pricing page explains how projects are structured in CAD. If you would like a straight read on where your current site stands, send us a message or email contact@webloped.ca. We will tell you plainly what to fix first, whether or not you hire us to do it.

Frequently asked questions

Is my small business website really a target for hackers?

Yes, in the sense that matters. Most attacks are automated scans looking for known weaknesses, not personal attacks on a chosen business. A small site with an outdated plugin, a weak password, or no two-factor authentication is an easy find for those scans, regardless of the size of the business behind it. The good news is that the same basics that protect large sites protect small ones, and most automated attacks move on when the easy doors are locked.

How often should I update my website software?

Apply security updates as soon as you reasonably can, within days rather than months, and turn on automatic updates for minor security releases where your platform offers them. Check the site after larger updates to confirm nothing broke. If you cannot keep up with updates yourself, a maintenance plan is worth it, because an update missed for a year is the most common entry point we see described in security guides for small business sites.

What should I do first if my website is hacked?

Contact your host or developer through a contact you already trust, change the passwords for your website admin, hosting, domain, and email, and take the site into maintenance mode if you can. Then restore from a clean backup or have the malware properly removed, and find and close the entry point before putting the site back live. If customer personal information may have been accessed, get privacy advice promptly about reporting and notification, and check Google Search Console for security warnings and a review request once the site is clean.

Does having HTTPS mean my website is fully secure?

No. HTTPS encrypts data in transit and shows visitors the connection is secure, but it does not stop an attacker who logs in with a stolen password, exploits an outdated plugin, or abuses an unprotected form. Think of HTTPS as one layer: necessary, expected by visitors, and easy to set up, but only part of the full list. Updates, strong passwords, two-factor authentication, backups, and monitoring do the rest of the work.