No matter the website, cybercriminals are always a threat. Website owners (and business owners) often think that their website doesn’t hold any valuable information to steal. That may or may not be true, but criminals aren’t always just after client data or business IP. After all, 43% of cyber-attacks target small businesses for a good (well, technically bad) reason.

Hackers also target websites to infect visitors with malware, host illegal downloads, or use the server as an email relay to send phishing messages or spam. Many also hack websites to use their servers for crypto mining or as part of a botnet. So clearly, there are still plenty of reasons for a business to protect their website, even if they think theft might not be a motivation.

Thankfully, it’s not too late to rectify and security holes that might be present. Just implement these 5 tips that cover the basic website security protocols every web owner and admin should know about.

1. Stick to Simple Error Messages

Error messages are meant to be helpful but sometimes they’re helpful for the wrong reason. If an error message gives away too much information, hackers can get valuable insights into the inner workings of the server and web client setup. Skip providing full exception details as well, since these can help them with attacks like SQL injection by providing additional information.

Users don’t need detailed error messages anyway. They can always log an issue if they’re having problems, and then that can be sorted out manually. Detailed error messages should only appear in server logs.

2. Keep Software Updated

Ensuring that software stays up to date is one of the easiest ways to waylay hacking attempts. Many cyber criminals run scripts that automatically crawl the web for websites with known software vulnerabilities. Software on the server-side and any that runs on the website, like extensions or a CMS, should be kept updated at all times.

It’s easy enough to set out a few minutes every week to check for new software updates. Some may even have settings that allow for automatic updates. If the website uses a managed hosting provider, it makes things even easier as they take care of the security updates for those systems.

3. Use a VPN When Logging Into the Site

A large part of web security isn’t directly related to the website, but rather external factors. For instance, network and device security are just as important. Website admins could log into the CMS or access server data from malware-infected devices or an unsecure network.

Most companies are already making use of VPN services to ensure their employees connect to their intranet securely. Website owners should be doing the same. A virtual private network is a service that applies an encrypted tunnel around the connection and prevents outsiders from intercepting any data in transit.

If you’re using your website for a business, you should definitely consider cybersecurity tools. For example, NordVPN Teams can provide your employees or colleagues with secure access and cutting-edge encryption. This is a perfect solution for businesses because it boosts your security and helps to surf online safely.

4. Focus on Passwords

The importance of having strong passwords is old news by now, yet a lot of people still neglect to use proper passwords. This goes for both server and website admin logins as well as user logins. Always insist on people creating strong and unique passwords for both, even if it’s annoying. Keeping the website (and user data) safe is more important than potentially scaring away a customer or two.

Also, ensure that any passwords stored on the server are properly hashed and salted. That way, even if the passwords are stolen, the damage will be limited as decrypting them becomes incredibly hard – and criminals will usually not think it’s worth the effort.

5. Validate on Client and Server Side

It’s important to validate user input on both the web (client-side) and the server. This is a critical control method to catch any malicious code before it can undermine the website or even make its way into the server database. Client-side validation is fast and tends to be able to catch simple mistakes, while server-side validation provides a deeper scrub to ensure there’s no malicious script.

Conclusion: Stay On Top of Web Security

Web security may seem like something that can be put on the back burner while more important business tasks get done first. Getting the website secure may not add to the business’s bottom line, but it can certainly detract from it if things aren’t handled properly. Keep in mind that regulations are getting tighter and a data breach might not just lead to a loss of customers but also heavy fines.