When people picture website security, they picture an attacker in a hoodie. In practice, the problems small sites run into are much more ordinary. A domain expires because the card on file changed. A secret key gets pasted into frontend code. A former contractor still has admin access. A backup exists, but nobody knows how to restore it.
None of these are hard to prevent. They just need someone to look, and then keep looking.
Good security for a small site is mostly good habits, applied consistently.
Why it matters
Your website is often the first thing a customer sees and the place where they trust you with their details. If it goes down, gets defaced or loses its domain, you lose more than a few days of traffic. You lose credibility that took years to build. A little routine care is far cheaper than a recovery.
What people miss
- SSL edge cases. HTTPS is usually automatic on modern hosts once DNS is right. But the “www” and non-www versions should both redirect to one secure address, and certificates need to keep renewing.
- Security headers. Small settings tell browsers how to treat your site, such as HSTS (always use HTTPS), X-Content-Type-Options, a frame policy to prevent your pages being embedded elsewhere, and a sensible referrer policy. Many DIY sites ship with none.
- Outdated dependencies. Code-based builds from tools like Bolt, Lovable, v0 or Replit pull in open source packages. Those get security updates, and someone has to apply them carefully.
- Exposed keys. Secret keys, like a Stripe secret key or a Supabase service_role key, must never appear in frontend code. If one has been exposed, it needs to be rotated, not just deleted.
- Admin access drift. Old freelancers, past employees and shared logins tend to pile up. Each one is a door.
- No two-factor authentication. Your domain registrar, your host and your builder account are the keys to everything. Each should have 2FA turned on.
- Untested backups. A backup you have never restored is a hope, not a plan. Databases, uploaded files and site code may each need their own approach.
- Domain renewals. Auto-renew should be on, the payment method current, and the registrar contact email one you actually read. Registrar lock should usually be enabled.
How AftUp handles it
You keep full ownership of your domain, code and accounts. We are added as users where possible, so you can always see and remove our access.
- Every plan includes 24/7 uptime and SSL monitoring, so we hear about outages and certificate problems quickly. When we get your site live in the first month, we set up redirects, check DNS and review account security as part of the work.
- Starter adds a monthly plain-English report that flags anything risky we notice, such as an expiring domain or missing 2FA.
- Growth gives you up to 2 hours a month of fixes, which typically covers adding security headers, rotating an exposed key, applying routine dependency updates, setting up backups or running a restore test. Fix response is within 1 business day.
- Scale adds up to 6 hours a month for larger cleanup and same-day priority response when something urgent comes up.
For the domain and DNS side in more depth, see hosting and domains. If you take payments, our payments page covers keeping that flow safe.
Do it yourself
Set aside an hour and work through this list:
- Turn on 2FA everywhere that matters. Registrar, host, builder, email and any payment accounts. Use an authenticator app where you can, and store recovery codes somewhere safe.
- Review who has access. Remove anyone who no longer needs it. Replace shared logins with individual users.
- Check your domain. Confirm auto-renew is on, the card is current, the contact email works, and registrar lock is enabled.
- Test HTTPS. Visit your site with and without “www” and with “http://” typed in. Each should land on the same secure address.
- Look for secrets in your code. Search for “secret,” “service_role” and “key.” Move anything sensitive to server-side settings and rotate it.
- Find your backups. Learn what your builder or host keeps and for how long. Then try restoring something small, like a copy of one page or a database export, so you know the process works.
- Check headers. Free online header scanners will show which security headers your site sends. Your host’s documentation will explain how to add them.
Our post-launch checklist collects these alongside the other first-week tasks.
If you would like a second set of eyes on your setup, the free site check will show you where you stand.