Is a small business website really a target?

Yes, but rarely personally. Most attacks are automated bots scanning the internet for old plugins and weak passwords. Any site with a known weakness gets hit sooner or later.

What is the single most important security step?

Strong unique passwords with two-factor login on the admin panel, hosting and domain registrar. A reused password is the most common way in.

Does HTTPS make my site secure?

HTTPS protects data on the way between the visitor and the site, and browsers warn when it is missing. It does not protect against weak passwords or outdated software.

How often should a site be backed up?

Daily for sites with orders or frequent changes, weekly for simple sites. Keep copies outside the main server and test a restore at least once.

Who should own the domain and hosting?

The business owner. Accounts should be in your name with your email, and your developer gets access, not ownership.

Does Kinto handle security after launch?

Yes, under the support plan: from $900 for 6 months, including updates, backups and monitoring.

Website security basics for small businesses

Website security sounds like a topic for banks and large stores. In reality most hacked sites belong to small businesses: a cafe, a clinic, a local shop. Nobody targeted them by name. An automated script found an old plugin or a password that had leaked elsewhere, and walked in. The good news is that a few basic habits stop most of these attacks.

1. HTTPS on every page

The padlock in the browser means data between the visitor and your site is encrypted. Without it, browsers show "Not secure" next to your address, and people hesitate to leave their phone number in a form. Certificates are free today and renew automatically. There is no reason to run a site without HTTPS. More in why SSL and HTTPS matter.

Price and timeline infographic: Six basics that block most attacks on small sites — Six basics that block most attacks on small sites

2. Passwords and two-factor login

Reused passwords are the most common way into small business sites. Fix it in three places:

Admin panel of the site.
Hosting or server account.
Domain registrar, where a stolen login means someone can take your domain.

Use a password manager, unique passwords and two-factor login wherever it is offered. When an employee or a freelancer leaves, change the passwords and remove their access the same day.

3. Updates

Sites built on popular CMS platforms rely on plugins and themes. Each one is code written by someone else, and old versions with known holes get scanned constantly. Update regularly, and remove plugins you do not use. Fewer moving parts means fewer ways in.

Sites built as static pages or with minimal server code have a much smaller attack surface. That is one reason Kinto builds lean sites without dozens of plugins.

4. Backups stored elsewhere

A backup on the same server as the site disappears together with the site. Good practice:

Automatic backups, daily for stores and sites that change often.
Copies stored outside the main server.
At least one test restore, so you know it works.

We cover this in detail in a separate article on website backups.

5. Forms and spam

Contact forms attract bots. Spam itself is mostly annoying, but forms that accept file uploads or send emails can be abused. Basic protection:

Hidden fields and rate limits that stop bots without bothering people.
File uploads limited by type and size.
Requests delivered to a Telegram chat rather than to a public email address.

6. Ownership and access

This is not a technical issue, but it causes more trouble than hackers do. If the domain is registered to a former developer and they stop answering, you can lose your site. Make sure:

The domain, hosting and analytics accounts are in the business owner's name.
You know the login email and it is one you control.
Developers get access as users, not as owners.

Security basics at a glance

Area	Minimum	Better
HTTPS	Certificate on all pages	Automatic redirect from http, HSTS
Passwords	Unique, long	Password manager plus two-factor login
Updates	When something breaks	Scheduled, with unused plugins removed
Backups	Monthly, on the server	Daily, off-server, tested
Forms	Basic spam filter	Rate limits, safe file handling, Telegram delivery
Ownership	You know who owns the domain	All accounts in the owner's name

What payment and personal data change

If your site takes online payments, card data should never touch your server. Payment pages from local providers handle the card details, and your site only receives the result. This keeps your site out of the most sensitive part of the process. See accepting payments online in Armenia.

For forms with personal data, collect only what you need. A booking form usually needs a name and a phone, not a passport number.

Signs something is wrong

The site redirects to strange pages, especially on mobile.
Google shows a warning next to your site in search.
New admin users you did not create.
Hosting reports unusual traffic or emails sent from your domain.

If you see any of these, change passwords, restore from a clean backup and find how the attacker got in, or the problem returns.

Cost of looking after security at Kinto

What	Price
Website with HTTPS, spam protection, backups set up	from $1,800, about 12 days
Landing page with the same basics	from $700, about 6 days
Support: updates, backups, monitoring	from $900 for 6 months

Full prices are on the pricing page. What support includes is described in website support: what is included.

Next step

If you are not sure who owns your domain or when your site was last backed up, start there. Write to @kinto_am on Telegram or leave a request on the website development page, and we will review your setup. We reply within 15 minutes, 10:00 to 20:00 Yerevan time.

Updated: 2026-10-15