Zur Hauptnavigation springen Zum Inhalt springen

Category: IT Security & Data Protection | Reading time: about 8 minutes | Author: Dietmar Engler

Cyberattacks are no longer limited to large corporations. Small and medium-sized businesses, in particular, are increasingly being targeted by attackers—often because they’re seen as easier targets. Yet many security vulnerabilities can be fixed with relatively little effort. We’ll show you the seven most important steps you can take to make your website significantly more secure by 2026.

Table of Contents

  1. SSL Certificate and HTTPS
  2. Regular Updates to CMS, Themes, and Plugins
  3. Strong Passwords and Two-Factor Authentication
  4. Regular Backups
  5. Web Application Firewall (WAF)
  6. GDPR-compliant implementation
  7. Accessibility
Cybersecurity Castle

1. SSL Certificates and HTTPS – A Requirement, Not a Bonus

Some companies still operate websites without a valid SSL certificate. Google marks such sites as “not secure,” and browsers display warnings. An SSL certificate encrypts communication between the browser and the server and is standard practice today. Let’s Encrypt offers free certificates.

Immediate Action: Check your browser’s address bar right now to see if your website starts with “https://.” If the padlock icon is missing, take action immediately.

2. Regular Updates to CMS, Themes, and Plugins

The most common entry point for attackers: outdated software. Whether it’s WordPress, TYPO3, or Shopware —the CMS itself, as well as all installed themes and plugins, must be updated regularly. Unmaintained extensions are responsible for about 97% of all WordPress security vulnerabilities.

Recommendation: Set up automatic updates for the core. For plugins and themes: check them manually at least once a month, or use managed hosting with automatic updates.

3. Strong Passwords and Two-Factor Authentication (2FA)

Admin accounts with weak passwords are an open door. Use only complex, unique passwords (at least 16 characters, a combination of letters, numbers, and special characters). Even better: Enable two-factor authentication for all admin accounts.

Tool Tip: Password managers like Bitwarden (free, open-source) generate and store secure passwords without requiring you to memorize them.

4. Regular Backups—External and Automated

What happens if your website gets hacked or the server is damaged? Without an up-to-date backup, this could mean the loss of all your data. Backups should be automated daily, stored off-site (not just on the web server itself), and regularly tested for recoverability.

Golden rule: A backup you’ve never tested isn’t a backup. Check at least quarterly to ensure a backup can be successfully restored.

5. Web Application Firewall (WAF)

A WAF analyzes incoming traffic and blocks known attack patterns—such as SQL injections, cross-site scripting, or brute-force attacks—before they reach the application. Many hosting providers offer WAFs as an optional or standard feature.

6. GDPR-Compliant Implementation

Data protection is not only a legal obligation but also a factor that builds trust with your users. Checklist:

  • Privacy policy is up-to-date and complete (including all tools and services used)
  • Cookie banner implemented in compliance with the law (no pre-checked consent boxes)
  • Data processing agreements (DPAs) with all service providers
  • No unauthorized disclosure of user data to third parties

7. Accessibility – required by law since June 2025

Since the Accessibility Enhancement Act (BFSG) took effect in June 2025, corporate websites must comply with the requirements of WCAG 2.1 AA. This applies to all private providers offering products or services to consumers. According to WebAIM, 96.3% of all websites currently do not meet these standards.

Tip: Have your website reviewed with a professional accessibility audit. Often, it’s just small, easily fixable adjustments—such as alt text for images or sufficient color contrast.

Would you like to know how secure your website really is? We offer a professional security check.

Book a Safety Check

Frequently Asked Questions

  • How often are small business websites attacked?

    More often than many people realize. Automated bots scan the internet around the clock for known vulnerabilities—regardless of a company’s size. Outdated CMS versions or insecure plugins are exploited within hours of a vulnerability being disclosed.

  • What should I do if my website has been hacked?

    Take immediate action: Take the website offline or put it into maintenance mode, notify your hosting provider, restore a clean backup, and then identify and close the point of entry. Afterward, all passwords should be changed and 2FA enabled. We’ll provide you with fast and practical support in an emergency.

  • Is my TYPO3 website automatically secure?

    No. TYPO3 also requires regular updates, secure configuration, and professional maintenance. Thanks to its structured core and lower adoption rate, a well-maintained TYPO3 system offers a smaller attack surface than WordPress—but no system can remain secure in the long term without active maintenance.