Your Website and Domain Are Part of Your Attack Surface — Here’s How to Protect Them

When SMBs think about cyber security, they picture laptops and email. The website and the domain name behind it are an afterthought — until the site is serving malware to customers, or worse, the domain itself is hijacked and every email and web visitor is redirected to an attacker. Your domain is the deed to your digital identity; treat it accordingly.

The domain: protect the deed first

• The registrar account (where the domain is managed) gets your strongest password and MFA — losing it means losing the domain, the website and email in one stroke.
• Turn on registrar lock so transfers require explicit approval.
• Keep renewal payment and contact details current — expired domains are snapped up within hours by squatters who then hold your identity to ransom.
• Add SPF, DKIM and DMARC records so criminals can’t send email as your domain — this protects your customers and suppliers as much as you.

The website: unglamorous maintenance beats clever attacks

• Update the platform and plugins — the overwhelming majority of small-business site compromises exploit a known, patched flaw in an outdated plugin or theme.
• Delete plugins and admin accounts you don’t use; every extension is someone else’s code running with your site’s trust.
• MFA on the site admin and hosting control panel — the same credential attacks that hit email hit /wp-admin.
• HTTPS everywhere, and independent backups of the site so a compromise is a restore, not a rebuild.

Why it matters beyond the site itself

A compromised small-business website rarely stays about the website. Attackers use them to host phishing pages under your good name, to seed malware into search results, and to harvest whatever your contact forms collect — which can make your site the source of someone else’s breach and a Privacy Act problem of your own. An hour a month of updates, plus locks on the registrar and admin accounts, removes you from the easy-target pool where almost all of these incidents happen.