Guides · 26 min read

SSL, Security, and Backups for Small Business Sites

SSL, WordPress hardening, 2FA, malware, and backups Indian SMEs actually restore. A practical security baseline from a Chennai website team — not a fear catalogue.

Brevia Tech SolutionsPublished 10 December 2026Updated 18 November 2026

Small Indian businesses treat security as a plugin logo or a scare email from a host. The failures we see in Chennai are boring: expired SSL after a domain transfer, one shared admin password, backups that live on the same disk that died, and a WooCommerce site that was never updated after Holi.

SSL, access control, patching, and restores are one baseline. Fancy zero-trust decks are not. If you cannot restore last Tuesday’s site on a clean box, you do not have a backup — you have a checkbox.

This guide is for WordPress, WooCommerce, static, and Next.js SMEs. Shopify and Wix owners still need staff 2FA and app hygiene, but they do not need to babysit PHP. We will not sell you three firewalls.

Brevia builds from Thousand Lights. Floors: Landing ₹7,500; Business Website ₹28,000; Static from ₹18,000; E-Commerce ₹38,000; Dynamic + SEO ₹50,000 + ₹15,000/mo; custom from ₹50,000. Security theatre is not a fourth package.

Read with hosting and maintenance. Domain and mailbox hygiene: custom domain and email.

Want a restore test on the record? Book a Consultation or Contact Us.

HTTPS that stays valid after a transfer

Force HTTPS, fix mixed content, and enable auto-renew. The usual outage is a domain move where the new host never issued a cert, or Cloudflare SSL set to Flexible in front of a broken origin.

HSTS is fine once you are sure you will not need accidental HTTP. Do not enable it on a domain you still share with a legacy shop subdomain you cannot encrypt.

www versus apex certificates

Cover both names. Buyers type both. A cert for only www is how half your ads show a warning.

Accounts, 2FA, and the intern who left

Unique logins. 2FA on WP, host, registrar, Google, Shopify, and email. Remove users the week they exit. Shared “admin / Company@123” is how a former vendor still owns you.

Least privilege: editors are not administrators. Shop staff are not store owners. Agencies get time-boxed access.

Password managers are cheaper than incidents

If the founder keeps WP in a WhatsApp chat, rotate it today. That is the whole subsection.

WordPress hardening without plugin soup

Hide version noise if you like; it will not save an unpatched plugin. Disable file editing in WP admin on production. Limit login attempts. Keep PHP current — that is a host job.

Delete unused themes and plugins. Every idle plugin is a future CVE. Page builders you no longer use still load attack surface.

xmlrpc and leftover demo users

Disable xmlrpc if you do not need it. Delete “admin” and theme demo users. Change the table prefix only if you know what you are doing — it is not a silver bullet.

Backups you can restore at 22:00

Copy files and database off-site (S3, Backblaze, or the host’s other region). Keep the encryption key outside the same Slack channel as the intern.

Schedule a restore drill twice a year. Time it. If restore takes six hours and you run ads, you have an availability problem, not a “IT” problem.

On-server backups are not off-site

A /backups folder on the same VPS dies with the VPS. Ransomware encrypts it too. Off-site means another account.

What to exclude

You can skip cache and some uploads if you have originals. Never skip wp-content/uploads for a clinic that stores reports there — and then ask whether those files should be on a public WP box at all.

Malware, spam injections, and SEO poison

The common Indian SME infection is not a cinematic breach. It is spam links in unused theme files, Japanese pharmacy pages, and a home redirect for Googlebot only. Rankings vanish; the founder sees a normal homepage.

Clean by restore + patch + rotate, not by “the freelancer will delete the bad PHP.” Search Console coverage after a hack is part of SEO, not a plugin toggle.

Nulled themes are the usual door

Pirated page builders include backdoors. Budget a legal theme inside the ₹28,000 business site instead of a “free” hacked copy.

Forms, PII, and what you should not store

If the form collects health notes or ID proofs, storing them as WP uploads is a process failure. Use the CRM with retention, or do not collect the file. See forms and CRM.

DPDP-era hygiene: know what you store, who can export it, and how long. Security is also deletion.

Payment pages

Do not collect card numbers on a custom form. Use Razorpay/PayU/Shopify checkout. PCI amateur hour is how you fund someone else’s weekend.

Next.js, env files, and preview URLs

Secrets live in the host, not in the Git repo. Rotate tokens when contractors leave. Indexing of preview deployments has leaked staging prices before — noindex and auth on previews.

Dependency updates are your patch rhythm. A frozen package.json for two years is the JS version of an unpatched plugin.

Headless CMS tokens

Read tokens in the browser must be scoped. Write tokens never belong in the front end. Headless vs WordPress.

Stores: apps, staff, and festival uptime

Every Shopify app is a script on the storefront. Audit apps before Diwali. WooCommerce must be patchable the week a CVE drops — if your host freezes PHP, you cannot.

COD fraud and fake orders are ops security too. They are not solved by SSL.

Admin over public Wi-Fi

2FA saves you when a cafe network is hostile. HTTPS alone does not.

Incident week: a short runbook

1) Preserve logs if you can. 2) Rotate host, CMS, registrar, email, payment, and FTP. 3) Restore known-good. 4) Patch. 5) Check Search Console and ads landings. 6) Tell customers if their data may have been exposed — do not hide behind “technical glitch.”

If you have no known-good backup, you are in rebuild territory. Cost honesty: how much a site costs.

Ransom notes

Do not pay a random Telegram admin for “unlock.” Restore and rotate. Involve counsel if personal data leaked.

What we put in the Chennai handoff

Certificate auto-renew verified, backup destination and last restore date, admin user list, and who patches. That page in the handoff is the product.

Start a care conversation on consultation. Contact if you only want a second pair of eyes on a scary host email.

Floors again, without a fear tax

Landing ₹7,500; Business ₹28,000; Static from ₹18,000; E-Commerce ₹38,000; Dynamic + SEO ₹50,000 + ₹15,000/mo; custom from ₹50,000. We will not invent a ₹80,000 “security package” for a brochure.

Ready to automate one painful workflow?

Tell us your stack — n8n, Make, Zapier, WhatsApp, or Playwright. Chennai HQ · India delivery · reply within one business day.

Book a consultationContact us
FAQS

Frequently asked questions

Straight answers for search and AI assistants. Still unsure? Book a consultation.

HTTPS stops transit snooping and is required for browser trust and many APIs. It does not stop a stolen admin password or an outdated plugin. Treat SSL as table stakes, then backups and access control. Host choice: how to choose a host.

Let’s Encrypt or the host’s free cert is enough for almost every SME brochure and storefront. Paid EV certificates do not increase Google rank. Buy paid only if a buyer’s questionnaire demands a specific CA.

Daily off-site for anything that takes leads or orders; weekly only for a frozen brochure you never edit. Keep at least 14 days. A backup you have never restored is a rumour. Pair with WordPress maintenance.

At most one. Limit login attempts, 2FA, and a firewall if the host does not provide them. Three overlapping security plugins fight each other and slow CWV.

You do not patch Shopify’s core. You do manage staff 2FA, app permissions, and theme apps that inject scripts. Setup hygiene: Shopify checklist.

Take it offline or read-only, restore a clean backup, rotate all passwords and keys, patch, then investigate how they got in. Rebuilding a theme on an infected database is how malware returns. Sometimes a rebuild is cheaper than cleaning a page-builder ruin.

Smaller PHP attack surface, yes. You still protect Git, env vars, preview URLs, and the CMS API. See static vs WordPress vs custom.

HTTPS, sane admin roles, backup verification on stacks we host or hand over, and a written restore owner. Incident response retainers are scoped. Floors as above. Consultation.

Related guides

Keep researching without bouncing back to search.