A lot of things can go wrong with your website – your website host could shut down without notice, a competitor could set up a DDoS attack on your website, or hackers could take advantage of a bug to steal confidential customer data.
Such attacks are not uncommon on small business websites. Over 43% of cyberattacks involve small business targets, and these attacks have cumulatively cost businesses over $2.2 million dollars a year.
Table of Contents
Why these attacks happen
Most business owners associate website foolproofing with making them hackproof. Yes, encrypting your database and fixing security bugs is an important part of running an online business. However, that is not the only way for small businesses to potentially fail with their website.
According to a report published by Kroll Ontrack, 67% of all data loss is caused by a hard drive crash, while 14% is caused by human error; these incidents can happen even if your website is secured against potential hackers.
Then, there are issues that do not involve the expertise of a hacker. A disgruntled customer or competitor could set up a DDoS attack on your website.
Discovering the various ways your website can become inaccessible, or, worse, pose a threat to your customers, and addressing these issues is thus an essential component of website management.
Start with an audit
The first step in foolproofing your website is to conduct a thorough audit of your back-end systems. Here are some questions for you to answer as you conduct this audit:
- Where is your data hosted?
- How is this data stored?
- How are you processing your customer information?
- Who has access to your database and customer details?
- Do you have the complete log of visitor IP addresses over the past 90 days?
- Do you see large volumes of inexplicable traffic to your website?
- What is your host’s backup policy?
- How often is your data backed up?
A website audit reveals a goldmine of information that can help your small business prevent a digital catastrophe.
But, sometimes, even an audit is not enough. If your employee (or the person from the agency you have contracted) is using a password that they already use on dozens of other websites, this puts your website in grave danger.
It’s not the older generation but tech-savvy millennials who use the same password for multiple applications. One report suggests that over 56% of millennials resort to workarounds for workplace security restrictions, and 85% admit to reusing passwords.
Conduct an anonymous survey of your employees to understand workplace behavior and to identify gaps that need to be filled with respect to website foolproofing.
Study the options
Once you have audited your website and identified what needs to be fixed, the next step is to plan the fix.
Cybersecurity can be expensive. Now, as a small business, you may not always have all the resources at your disposal to build a totally foolproof website.
A cost-benefit analysis of the various alternatives can give you a good idea of how to best secure your website without breaking the bank. There are free, cheap and expensive options to choose from to address every aspect of cybersecurity.
Let us take the example of securing an SSL certificate for your website. Popular brands in this space offer certificates that can cost anywhere between $400 a year to $2,000 a year. You also incur other expenses like deploying a CDN (content delivery network), which costs a few hundred dollars a year. These costs can easily add up.
There are free but reliable alternatives that you could instead invest in. What’s the difference? While the paid plans that cost hundreds of dollars offer benefits, like insurance for potential malfunctions, the free plans only secure your website and do not offer any warranties. Which of these options is right for your business is something that only you can answer.
One way to assess these options is by listing the various potential breaches your business could likely face, and ranking them in order of their frequency and threat to your business.
A DDoS attack can be a nuisance for some businesses, while for others, it can threaten their very survival. Depending on the threat, you may have to install more than one layer of protection.
The other way is to analyze your threat by the platform you are using. Popular CMS and e-commerce platforms are used by millions of businesses. To a potential hacker, this is lucrative, because one vulnerability can help them gain back-door entry into hundreds, even thousands, of websites. On the positive side, the large ecosystem of users also means that there are dozens of plugins and extensions to help you protect your website.
Your website is a less attractive target if you have a custom-built website. However, such websites are also relatively easier to break into, since they have not been as rigorously tested as platforms that have been used on millions of websites. Besides, as a small business owner, your resources are better spent on marketing and sales rather than building a custom platform from the ground up.
Implement a robust cybersecurity plan
Every website is vulnerable to failure. You can only protect against vulnerabilities that you know of. Regardless of how many security apps you have invested in for your online store, one must be mindful of a potential failure or breach from the unknown.
You do this by preparing your business for what lies beyond a website failure. Here are some things you must do:
- Uptime monitoring: If your website is only a portion of your overall business strategy, chances are that you fail to notice an attack until it’s too late. An uptime monitoring system, along with a change monitoring system, can constantly ping your website for the latest status and notify you in case something is amiss.
- Automate backups: Your database can go missing anytime, either due to human error or from a coordinated attack. Setting up an automatic backup of your systems would mean that no matter what happens, your website can still be brought back online immediately.
- Encrypt everything: Websites that fall prey to hacking incidents not only lose their database but also all the trust that their customers place in them. One way to mitigate this disaster is by encrypting anything that can be of value to the hacker. This includes customer names, email addresses, phone numbers, payment information, and, of course, passwords.
- Use a password manager: Many people do not realize this, but most instances of hacking and data breach happen through phishing, a strategy where passwords are captured by showing a fake version of the original website. This can be completely avoided with the help of password managers. There are a couple of more advantages with password managers: First, you can ensure that each password your employees use for various applications is unique and highly secure (since they do not have to worry about remembering them anymore). Second, many password managers also permit users to share their passwords with others without actually revealing them. Small businesses that work with agencies can use this strategy to share confidential password details with third-party contractors and freelancers.
- Establish protocols: A big reason why so many small business websites fail is that they do not have established protocols. Want to make a small change to the homepage title? Many website owners do not think twice before making this change directly on the live website. This is highly risky and is a reason for many failures. The right protocol, in this case, would be to have two versions of your website: the test version and the live version. Before you make any change, you create a copy of the specific page in the test server. Once the change has been implemented and tested here, you can deploy it on the live website. This protocol ensures that no change gets implemented in the live version without being tested thoroughly. The chances of failure are greatly minimized this way.
All of this may sound intimidating to someone without a lot of tech experience. The good thing, however, is that there are a lot of apps and services that can help you out here at minimal expense. This is an investment that insures against a lot of heartburn and potential disruption in the future.
