You’re a small business and you can’t really afford to pay big bucks for website security. Besides, who’s going to bother hacking your site when there’s big businesses to mess with?

We covered seven fallacies to website security in the last post, beginning with having a false sense of security simply because you’re a small- or medium-sized business. This actually makes you a prime target because hackers know small companies don’t have the same resources available for protecting their business online. The good news is there are some great free and low cost options to keeping your website safe.

Get A Website Security Plugin

If you don’t already have Wordfence, you’re one plugin download away from an improved security firewall and malware scanner, its two core security capabilities. Wordfence scans for any new malware and provides new firewall rules to protect against attacks, using real-time data for paid premium accounts and a thirty-day delay in updates for all free versions.

The forensic detection work is ongoing so the latest malware threats are constantly being optimized. If you’re a free Wordfence customer, your site is currently getting 364 free malware scan signatures, with another 118 in the signature line-up to be added. Last month alone nearly 140,000 websites were found infected with malware. Don’t wait to be one of them. Get your site secured with a reputable plugin, or ask your web hosting provider for help with one of their security services.

Give Up Your Username, Your Password, and Your False Sense of Security

When it comes to site security, the point of entry that serves as an easy break-in is your site’s front door. If you’re using a username that includes admin or administrator, or the name of a site author or contributor, you’re making it too easy for a hacker to determine exactly half of your front door’s access information.

Follow this post on How To Change Your WordPress Username using Cpanel to secure the front half of your website’s entry portal. The other half involves changing your password to something that doesn’t fall into the most commonly used or worst password list .

Don’t let weak passwords allow hackers access to your website. Strengthen your passwords by changing them occasionally, using password strengthening tools like Strong Password Generator or Norton Password Generator, storing them in password managers, and forcing other WordPress users on your site to use better passwords with the Force Strong Passwords plugin.

Your Biggest Source of Security Trouble Is An Update Away

Check WordPress.org to see the last update of your plugins and delete or replace the ones that you’re no longer using and those that haven’t been updated in the last year or so. While you’re there, also check the plugin’s rating and how many people have contributed to the rating. The more people who use it and like it, the more likely it will be safe to use.

Finally, look to see if it’s compatible with the current version of WordPress. If a plugin has its own website, there’s a better chance it is being well maintained. Once you’ve done the basics of plugin selection criteria, your main concern is to keep all plugins updated. Never download a plugin unless it’s from the  official WordPress plugin directory.

Clever SEO Tactics That Land You In Google Time-Out

Honest mistakes made in an effort to improve your search engine ratings and boost traffic are still that—mistakes. You need to know what you shouldn’t do to boost SEO or Google will blacklist you. Blacklisting is like getting the monopoly “go to jail” card, and no one comes to visit.

Buying Links or Linking to Spam

This is going to lead to unnatural, spammy linking because most of these offers for paid links are from disreputable sites and social media accounts. Even if they promise you first page ranking, because eventually you’ll be totally unranked, and it’s not worth it.

Always check before you link to another page. If it’s a malicious webpage, it’s only a matter of time before your site could be infected with malware or Google blacklists you for the link. You don’t want Google to ever discover you’re linked to any of these malicious cyber spaces.

Broken Links

This might not land you on the blacklist, but it’s definitely going to hurt your SEO. If you have a page with several broken links, Google is less likely to see it as updated and a page without any broken links will easily outrank yours.

Yet broken links are a dime a dozen. Sites move, go out of business, undergo remodeling, and once intact links are no longer viable. So what do you do? Spend hours going through hundreds of pages checking?

Who has time for that? Go straight to Google Webmaster Tools (and make an account if you don’t already have one) and fix any broken links that it gives you.

Copyright Offense

Violating copyright is not only unethical. It’s a big Google no-no. This will send you right off the Google radar and into a black hole of oblivion. You’ll eventually get caught and lose your ranking. 

Keyword Stuffing and Masking

Whether it’s irrelevant keywords or hidden text or links, Google is very clear about the repercussions. Either you’ll harm your site’s ranking or you’re violating Google’s Webmaster Guidelines. Create quality content and stick to the high road where you’ll see authentic and lasting returns on your efforts.

A blacklisted site might show the warning “This site may be hacked” when you search for it in your browser. Go to Google’s Safe Browsing Site Status to check for blacklisted sites. Get help for blacklisted or hacked sites on Google’s help page. 

If you’re a small business, don’t be under the illusion that you’re too small for singling out by hackers. You could be one of the growing number of small businesses who have moved into the cyber crime spotlight.

According to Symantec Security Response, 50% of all targeted cyber attacks are on businesses with fewer than 2,500 employees. In 2012, businesses with fewer than 250 employees saw an increase in attacks from 18% to 31% in just one year.

The top businesses and occupations targeted are:

• Manufacturing –  received the greatest number of attacks in 2012; at 24% of the attacks, they got twice the number as government organizations.
• Finance, Real Estate, and Insurance – hit with 19% of the attacks.
• Research and Development – highest target for job occupations at 27%.
• Sales Representatives – 24% of targeted job occupations.

So what are cyber criminals looking for? When you look at the use of the stolen data, the information tells us they want trade secrets, products plans, and customer and employee data. All your proprietary information that can be used to help competitors gain an advantage or be sold to unscrupulous organizations. Your social security and driver’s license numbers, addresses, credit card numbers, health and financial history, purchase information, and other private details are up for grabs.

The news is continually warning us about data breaches that occur at all levels and includes major retailers, hotel chains, government organizations, and other businesses. In July the headlines were about the breach on government systems affecting 21.5 million people and is related to the previous month’s government breach compromising an additional 4 million with stolen sensitive information.

This government incident is “not without precedent,” and “cybersecurity in both the private sector and the public sector” must be raised, said Michael Daniel, the White House cybersecurity coordinator.

Cybersecurity has been a documented issue going back to 1997. In a cover letter to the President on the Report of the President’s Commission on Critical Infrastructure Protection, it reads, “We did find widespread capability to exploit infrastructure vulnerabilities. The capability to do harm—particularly through information networks—is real; it is growing at an alarming rate; and we have little defense against it.”

So what are we doing about it? What measures should you be taking to protect confidential business data and private personal information?

INTERPOL, the world’s largest international police organization with 190 member countries, is committed to becoming a global coordination body on the detection and prevention of digital crimes. They advise that we do two things to protect our business and personal data.

Update your OpenSSL.

For website owners, it’s important that you have an updated OpenSSL. The Heartbleed vulnerability in encryption software which is used by the majority of online web servers is leaving nearly everyone open to one of the biggest cyberattacks in the internet’s history.

Heartbleed lets its attacker anonymously download a random chunk of memory from the server, including secret keys, passwords, and other personal information. The secret keys are the most problematic because this opens the door for even more secret information to be revealed.

The bug went undiscovered for two years until being uncovered in April of 2014, and it’s predicted that the ripple effects could continue for years. Vulnerable versions are still being used on websites, most likely small e-commerce sites that don’t have the administrative support to patch things up.

If you’re concerned about a website, you can use this handy Heartbleed checking tool to check if it’s vulnerable.

Speaking of updating, keep all your software programs and websites up to date and backed up for added security.

Change your passwords.

INTERPOL says to use unique passwords for each of your online accounts and to change them often. While this may be wise in theory, in reality it’s difficult to carry out. Start by changing important accounts, ones that have financial information on them, for example.

Create strong passwords that are at least eight characters long and use a combination of letters, numbers, and symbols. Don’t use words from the dictionary (the use of symbols comes in handy here) and don’t use personal information that is readily available, such as your name, birth date, or apartment number.

What else can you do? Here are a few more preventative measures to use in protecting yourself from cybercrime.

Get two-factor authentication.

When a site offers this step, use it. If you are a site owner, enable it for your customers and subscribers. One of the largest attacks on banks occurred in 2014 when failure to enact two-factor authentication at one of the bank’s servers caused a weak point in the bank’s security, allowing the hackers to access 90 other servers in their network.

Be careful what you click on.

One of the ways hackers manage to steal information is through infecting your computer. Malware such as remote-control Trojan programs, worms, viruses, and botnets can affect computers using sophisticated techniques.

Spam email, infected files on downloads, and malicious pop-ups and links can all infect your computer, which in turn can be used by hackers to launch DoS attacks or send spam with even more malware.

Always think twice before going to a website that’s unknown to you, and if you do, type a legitimate address in a new browser tab instead of clicking on a suspicious link. Never trust an email from an unknown source.

Put barriers in place.

Utilize the best tech barriers you can afford, like this cloud-based security app for mobile phones. Anyone operating their computer without some serious security software is taking a huge risk. Install and regularly update virus protection and adware/spyware removal software programs to keep malicious applications from invading your privacy.

Good luck — it’s a digital wild west out there.