A security checklist for small-business websites and apps

A small-business website or app needs a short list of security basics in place before launch: HTTPS everywhere, patched dependencies, multi-factor authentication on every admin account, tested backups, clearly defined access control, and a lawful basis for the personal data it collects under Nigeria's Data Protection Act 2023 (NDPA). None of this needs an enterprise security team. It needs a checklist and someone who owns it.

Small businesses are a common target not because attackers choose them deliberately, but because automated scanning tools probe millions of sites for the same handful of known, unpatched issues, and a smaller site often has fewer defences in the way. Most of what follows costs little to fix and takes longer to write down than to actually do.

The baseline: HTTPS, updates and MFA

HTTPS should cover every page, not only a login form or checkout page, and every request over plain HTTP should redirect automatically. Certificates should renew themselves rather than depending on someone remembering a renewal date. Content-management systems, plugins and code dependencies should be patched on a regular schedule rather than only when something breaks, since most breaches exploit a known, unpatched vulnerability rather than a novel attack. Multi-factor authentication belongs on every account that can change the site or move money, not only the main admin login.

• Force HTTPS on every page, with certificates that renew automatically
• Patch CMS, plugin and package dependencies on a regular schedule, not only when something breaks
• Turn on multi-factor authentication for hosting, domain registrar, CMS, email and payment accounts
• Remove admin accounts for people who no longer need access

Backups you have actually tested

A backup schedule only protects you if a restore has actually been tried. Many businesses discover their backups were incomplete, corrupted or simply not running only when they need one. Backups should run on a schedule that matches how often the data changes, store at least one copy away from the primary hosting account, and be restored at least once as a test rather than trusted on faith.

Write down how long a restore actually takes, and who is able to perform one without waiting on a single person who happens to hold the credentials. A backup nobody but one departed contractor knows how to restore is, in practical terms, not a backup at all.

Access control and vulnerability scanning

Access should follow the principle of least privilege: a person or service gets only the permissions their role needs, not full administrator access by default. Review who has access to production systems at least twice a year, and remove access immediately when someone leaves the team. Automated dependency and vulnerability scanning, run as part of building and deploying the code, catches known issues in third-party packages before they reach a live site.

Secrets such as API keys, database passwords and payment credentials should live in an environment variable or a secrets manager, never committed into the source code or shared over chat. Rotate a credential immediately if a laptop is lost, a contractor's engagement ends, or a key is accidentally exposed, rather than waiting for a scheduled review.

• Grant the minimum access each role or service actually needs
• Review production access at least twice a year and after every departure
• Run automated dependency and vulnerability scanning on every deploy
• Store secrets in environment variables or a secrets manager, never in the code

NDPA basics for a Nigerian business

The Nigeria Data Protection Act 2023 applies to any business that collects personal data from people in Nigeria, including names, emails and phone numbers gathered through a contact form. It expects a lawful basis for collecting that data, such as consent or a legitimate business reason, a clear statement of why it is collected, reasonable security measures to protect it, and a way for someone to ask what you hold on them and request that it be corrected or deleted. Depending on how much data a business processes, registration with the Nigeria Data Protection Commission may also apply, which is worth checking with a lawyer rather than assuming either way.

In practice, this means writing a short, plain-language privacy notice that says what a form collects, why, and how long it is kept, and publishing it somewhere a visitor can actually find before they submit their details. It also means having an answer ready when someone asks what data you hold on them, rather than treating the request as unusual.

What to ask a vendor before you sign

A vendor building or maintaining your website or app should be able to answer a short set of security questions without hesitation. If they cannot, treat that as useful information.

It also helps to agree, in writing, what happens if something does go wrong: who is notified first, how quickly credentials get rotated, and who tells affected customers, and when. A short, written incident plan agreed before launch is far calmer to follow than a decision made for the first time during an actual incident.

• Who owns the code, the domain and the hosting account after handover
• What security review happens before launch, and is it written down
• How often backups run, and when a restore was last tested
• What the process is if a vulnerability is found after launch