Fewer moving parts
This site is static: plain files with no server, database or login page to break into. If a site doesn't need those things, it shouldn't have them.
Tell browsers what's allowed
Security headers tell a visitor's browser what the site may and may not do: which scripts can run, whether other sites can embed it, and that it must only load over HTTPS. They take minutes to add and close off whole types of attack.
Lock the doors you already have
- Two-factor login on hosting, the domain registrar, email and your shop
- A transfer lock on the domain, so nobody can move it without you
- Logins and recovery codes kept in a password manager, never in shared folders or documents
Protect your email name
Three DNS records (SPF, DKIM and DMARC) stop scammers sending email that claims to come from your domain. Many small businesses have none of them set up properly, and it's one of the cheapest fixes there is.
Collect less, protect what you collect
Contact forms should ask only for what's needed, filter out spam and send enquiries straight to you, rather than leaving them sitting somewhere else.
Keep a way back
Keep the software a site depends on up to date, and make sure every version of the site is saved, so a bad change can be rolled back in a click.
Written by Ernie Hoggard, founder of Ernex.