Most website security advice starts with a sales pitch. A $99-a-month scanner, a managed firewall, a “we’ll harden your site for you” retainer — all useful eventually, but not where the highest-leverage fixes actually live. The sites that get compromised are almost never taken down by something exotic. They go down over free things nobody closed: a reused password, a login page with no rate limit, an admin username sitting in plain sight, software three versions behind on a patch that shipped six months ago.
None of that costs anything to fix. It costs time, and a willingness to go down a list and actually do it — which is the part most guides skip in favor of naming tools.
The free fixes that matter most
Before spending a dollar on a security product, this is the list worth clearing first. Every item here is either built into your platform already or free to add:
- Kill password reuse and turn on two-factor authentication. Almost every high-profile breach traces back to a credential that was stolen somewhere else and reused on the site that got hit. A password manager plus 2FA closes that door for free.
- Rate-limit your login page. A login form with no limit on failed attempts is an open invitation to brute-force bots — and they scan the entire internet for exactly that, constantly, whether or not anyone is targeting you specifically. Locking an IP out after five or six failed attempts stops almost all of it.
- Update everything, not just the parts you notice. Core software, plugins, themes, and the server’s own packages. The patch that fixes a known vulnerability is usually public before most site owners get around to applying it — that gap is exactly what gets exploited.
- Force HTTPS everywhere, not only on the login or checkout page. A free TLS certificate now takes minutes to set up, and there’s no longer a good reason to serve any page over plain HTTP.
- Stop using an obvious admin username. “Admin,” your name, or your business name as the login username hands an attacker half the puzzle before they’ve tried a single password.
- Turn off what you don’t use. Unused plugins, dormant user accounts, file-editing from inside the CMS admin panel, remote-post APIs nobody calls — every one of these is a door that costs nothing to lock and nothing to leave open.
- Add basic security headers. HSTS, X-Frame-Options, and X-Content-Type-Options take a few lines of server config and close off entire categories of attack — clickjacking, protocol downgrade, MIME sniffing — for the price of editing one file.
- Back up on a schedule, and actually test the restore. A backup nobody has ever restored from is a belief, not a safety net. Confirm it works before you need it to.
None of this requires a security background. It requires treating the list as a checklist, not as inspiration.
A locked door doesn’t need to be unbreakable — it just needs to take longer to open than the attacker is willing to spend. Most of what compromises small business sites is automated and opportunistic, not a targeted attack. The free fixes above are usually enough to make a bot move on to an easier target.
Where AI fits into the picture — in both directions
AI is increasingly part of the defensive side of this equation too — anomaly detection that flags unusual login patterns, automated triage of security alerts, faster response when something does slip through. For a small team without a dedicated security person, that kind of automated monitoring is one of the few ways to get enterprise-level coverage without hiring for it.
But the same technology cuts the other way. The risks AI introduces are just as real as the defenses it enables — more convincing phishing emails with none of the broken grammar that used to give them away, malware that adapts faster than signature-based tools can catalog it, and social engineering that scales in a way a human scammer working alone never could. Treating “we use AI” as an automatic security upgrade, on either side of the fence, misses that it’s a force multiplier for whoever’s using it — including the people trying to get in.
The practical takeaway: AI-assisted monitoring is a good complement to a hardened site, not a replacement for the checklist above. It catches what slips past the basics — it doesn’t excuse skipping them.
Everyday habits that matter as much as the server config
A hardened website is only as secure as the person who has the keys to it. Most breaches that don’t come through a technical vulnerability come through a person — a phished password, a reused login, a device that wasn’t locked. Public awareness resources on AI and everyday security exist for exactly this reason — the habits that protect a personal inbox are the same ones that protect the admin account sitting behind it:
- Use a password manager and unique passwords everywhere, especially on the email account tied to your site’s recovery flow — it’s usually the real target, not the site itself.
- Treat unexpected links and attachments as suspicious by default, even from names you recognize. A convincing-looking message is cheap to fake and increasingly cheap to generate.
- Keep the devices you manage the site from updated too — a compromised laptop makes every other fix on this list irrelevant.
- Avoid logging into admin panels over public Wi-Fi without a VPN.
None of this is glamorous. It’s also almost entirely free, and it closes the gap that the technical checklist above can’t — the human one.
When DIY security has a ceiling
Clearing every item above puts a site ahead of most of the internet. What it doesn’t do is watch the site after you’ve moved on to the next task — logs, update cycles, and monitoring are a recurring job, not a one-time project, and that’s usually where the free approach runs out of runway. This is the same gap AI-powered automation is built to close on the operations side of a store: the parts of the job that need to happen continuously, not the parts that happen once and get forgotten.
If you’ve worked through the checklist and still aren’t sure where your site actually stands, that’s a smaller problem than it feels like — a free audit will tell you exactly what’s left, no third party required to find out.