Website Security for Australian Small Businesses: A Practical Checklist

Website security for an Australian small business means protecting the site, its admin accounts and the customer data it collects so attackers cannot take it over, steal data or use it to defraud you. In practice that is a short list of habits: multi-factor sign-in, prompt updates, least-privilege access, tested backups, monitoring and a written plan for reporting incidents.

This guide is written for owners and managers of small and medium businesses whose website is a brochure site, a booking or enquiry tool, a customer portal or an online store. It is the Australian companion to our general website security checklist, which covers the generic depth on HTTPS, sessions, input validation and the OWASP Top 10. Here we focus on what changes in Australia: ASD's Essential Eight as a benchmark, the difference between good practice and legal obligations, and where and when to report an incident.

Facts are sourced and dated; recommendations are labelled as ours; examples are hypothetical. Nothing here is legal advice. For your obligations, check with the OAIC, ASD's Australian Cyber Security Centre (ACSC) or an adviser.

ASD figures. ASD's ACSC received over 84,700 cybercrime reports in FY2024–25, an average of one every six minutes, according to its Annual Cyber Threat Report 2024–25 factsheet for businesses. The same factsheet gives the average self-reported cost of cybercrime per report by business size, shown below. The most common cybercrimes reported by businesses were email compromise with no financial loss (19%), business email compromise fraud with financial loss (15%) and identity fraud (11%).

Read these numbers carefully. They are averages per report, self-reported by victims who chose to report. They are not the total cost of a typical incident, not a prediction of your loss, and not a measure of how many businesses were attacked. ASD itself notes that much cybercrime goes unreported.

OAIC figures. The OAIC received 1,205 data breach notifications in calendar 2025, up 8% from 1,112 in 2024 and the highest since the scheme began in 2018. Malicious or criminal attacks accounted for 716, and the OAIC says ‘cyber hacking remains the primary cause of data breaches reported to the OAIC’. Health service providers notified the most breaches (225, or 19%), followed by finance (157) and the Australian Government (118) (OAIC, July 2026).

What this means for a website. Two patterns stand out for small businesses. First, email and account compromise dominate, so the controls that protect logins (multi-factor authentication, passkeys, removing old accounts) matter more than exotic defences. Second, breaches of personal information are rising, and a website is often where that information is collected: enquiry forms, bookings, accounts and orders.

Many security articles blur ‘you should’ and ‘you must’. For a small business that matters: if you treat guidance as law you may spend money you did not need to, and if you treat law as optional you may miss a reporting deadline. We suggest keeping two separate lists, reviewed at least once a year.

List 1: general recommendations. These are good practice that applies to almost every business: the controls in this checklist, ASD's Essential Eight, the OWASP Top 10:2025 for web applications and the NIST Cybersecurity Framework 2.0. The Essential Eight is guidance, not a legal requirement for private businesses. Customers, insurers and government buyers may still make some of it a contractual requirement, which is a different thing from law.

List 2: legal obligations. These depend on your size, sector and what happened. The table below summarises the ones most relevant to a website. It is a starting point for a conversation with an adviser, not a complete legal map.

Many website compromises start with an account: a reused password on the CMS admin, a phished hosting login, a forgotten agency account or a shared email inbox that controls password resets. Protect the accounts that control the website before anything else.

Multi-factor authentication (MFA). Turn it on for the CMS or store admin, the hosting control panel, the domain registrar, DNS, the email accounts that receive password resets, code repositories and the payment provider dashboard. These are the accounts that let someone take the whole site, not just one page.

Passkeys where available. The FIDO Alliance describes passkeys as ‘a password replacement technology’ and says they are ‘phishing resistant and secure by design’ (FIDO Alliance). Because a passkey is tied to the real site, a convincing fake login page cannot collect it. Use passkeys for admin and staff accounts where your platforms support them; use an authenticator app where they do not. Codes sent by SMS are better than nothing but are the weakest option.

Least privilege. Give each person the lowest role that lets them do their job. Content editors do not need to install plugins; a marketing contractor does not need billing access. Keep a small number of named administrators, never a shared ‘admin’ login, and review the list monthly.

Unpatched software is the other common opening. A small business website typically depends on a CMS or ecommerce platform, a theme, a dozen or more plugins or packages, a runtime such as PHP or Node.js, and the server or hosting stack underneath. Each one receives security fixes, and each one eventually stops receiving them.

Patch on a timetable, not when you remember. ASD's Essential Eight Maturity Model (November 2023) sets, at Maturity Level One, patch timeframes of 48 hours for vulnerabilities in internet-facing services that are critical or have working exploits, and two weeks for other applications such as browsers, office suites and security products. We have taken these from ASD's published summaries; check the current model for the exact wording. Even if you do not aim for a maturity level, they are a useful yardstick: a public-facing website is an internet-facing service.

Check runtime support dates. As of 9 October 2026, php.net lists PHP 8.1 and earlier as end of life, PHP 8.2 and 8.3 as security fixes only (until 31 December 2026 and 31 December 2027) and PHP 8.4 and 8.5 as actively supported (PHP). The Node.js project lists v20 as end of life, v22 and v24 as LTS, and says ‘Production applications should only use Active LTS or Maintenance LTS releases’ (Node.js).

Manage dependencies deliberately. Software supply chain failures are now a category of their own in the OWASP Top 10:2025. Keep a list of plugins and packages, remove anything unused, prefer well-maintained components, turn on vulnerability alerts in your repository or hosting, and test updates on a staging copy before production. Our guide to building a secure business website covers how to design this in from the start.

TLS everywhere. Serve every page over HTTPS, redirect plain HTTP, renew certificates automatically and check that renewal actually happened. Turn off old protocol versions at the host or CDN where you have the option. The generic website security checklist covers headers and sessions in more detail.

Secrets out of code. API keys for payment providers, email services, CRMs and accounting systems belong in environment variables or a secrets manager, not in the code repository, the theme files or browser JavaScript. Use a separate key per integration and per environment so one can be revoked without breaking the rest, and rotate high-value keys on a schedule. Integrations multiply secrets quickly; our guide to API integration for Australian businesses covers how to scope and rotate them.

Backups an attacker cannot delete. Back up both the code and the data (database and uploaded files). Keep at least one copy somewhere the website's own admin and hosting credentials cannot reach, because ransomware operators and intruders look for backups first. Test a restore to a staging environment every quarter: a backup you have never restored is an assumption.

Where backups live is a privacy question. If backups or hosting sit overseas and contain personal information, APP 8 may apply. The OAIC's guidelines explain that, before disclosing personal information overseas, an entity must take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles, and that overseas cloud storage can be treated as a ‘use’ rather than a ‘disclosure’ where a binding contract limits how the provider handles the data and the entity keeps effective control (OAIC APP 8 guidelines). Ask your host where backups are stored, and take advice if you are unsure.

Detection is where small businesses are weakest. A site can be quietly serving spam pages or skimming payment details for weeks before anyone notices. You do not need a security operations centre; you need a few alerts that reach a named person.

What to watch. Failed and successful admin logins, new admin accounts, changes to plugins or theme files, unexpected outbound traffic, uptime, certificate expiry and changes on payment pages. The OWASP Logging Cheat Sheet recommends logging authentication outcomes, access-control failures and high-risk actions such as privilege changes (OWASP).

Use free signals. Google Search Console's Security Issues report shows Google's findings when a site ‘was hacked or behaves in ways that could harm visitors’, covering hacked content, malware and unwanted software, and social engineering (Google). Verify your site and make sure alerts go to someone who reads them.

Keep logs long enough to investigate. If you have to assess a suspected breach, you will need to know what was accessed and when. Agree retention with your host and store copies of critical logs outside the web server.

ASD's Essential Eight is the Australian benchmark most often referenced in supplier questionnaires and cyber insurance forms. Its eight mitigation strategies are: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. ASD defines maturity levels one to three, each targeting increasingly capable adversaries.

The Essential Eight was written for an organisation's IT environment as a whole, not for websites specifically, and some strategies (macros, application control) are about staff computers. The table is our own mapping of how each strategy translates to a small business website and the people who run it. It is guidance, not a compliance assessment.

When something goes wrong, the first hours are spent working out what happened. Deadlines and reporting duties should not be something you look up for the first time during an incident. Write a one-page runbook now, and include the reporting routes below.

Contain and preserve. Take the affected site or account offline or into maintenance mode, change and revoke the credentials involved, and keep logs and copies of affected files before you clean up. Restoring over the evidence makes it harder to know what data was touched.

Report the cybercrime. ASD's ACSC asks businesses to report cybercrime and cyber security incidents through cyber.gov.au/report, which includes ReportCyber, and runs the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), staffed 24 hours a day. If you are unsure which route applies, the hotline can help.

Assess for an eligible data breach. Under the Notifiable Data Breaches scheme, a breach is ‘eligible’ when there is unauthorised access to, unauthorised disclosure of, or loss of personal information; this is likely to result in serious harm to one or more individuals; and the entity has not been able to prevent the likely risk of serious harm with remedial action (OAIC). If you suspect one, OAIC guidance says you must take all reasonable steps to complete the assessment within 30 calendar days, and once you have reasonable grounds to believe it is eligible, notify the OAIC and affected individuals as soon as practicable. The OAIC treats 30 days as a maximum, not a target.

Report any ransomware payment. Mandatory ransomware and cyber extortion payment reporting has been active since 30 May 2025. It applies to businesses carrying on business in Australia with annual turnover over AUD 3 million (per Home Affairs), and to responsible entities for critical infrastructure assets. The report goes to ASD within 72 hours of making the payment, or of becoming aware it was made on your behalf. No report is needed if a demand was made but nothing was paid. A civil penalty of 60 penalty units may apply for failing to report, and from 1 January 2026 Home Affairs describes a ‘Compliance and Education Approach’ with a more active regulatory focus (Home Affairs factsheet).

A note on the threshold wording. The Home Affairs factsheet describes the threshold as turnover that ‘exceeds’ AUD 3 million in one passage and as ‘$3 million or more’ in another. If your turnover is close to AUD 3 million, take advice rather than relying on either phrasing. Businesses trading for part of a year pro-rate the threshold, and not-for-profits are not explicitly exempt. Paying a ransom is not generally prohibited, but the government strongly discourages it, and sanctions and anti-money-laundering laws may still apply.

Most small businesses do not run their own servers. A web agency, a hosting company, a managed service provider (MSP) and a handful of SaaS tools hold admin access to the website. Their security is part of yours, and the shared responsibility split is rarely written down.

ASD's ACSC publishes ‘Questions to ask managed service providers’, built around five questions: are you implementing better practice cyber security, such as the Essential Eight; are you securely administering your systems and services; are you monitoring activity on your systems and services; are you regularly assessing your systems and services; and are you prepared for, and able to respond to, cyber security incidents. We could not load the ACSC page while checking, so the wording comes from ASD's published summaries.

Our additions for web suppliers. Ask who holds which admin accounts and whether they use MFA; how quickly they apply critical updates and who pays for that time; where hosting and backups are located; how they will tell you about an incident affecting your site, and how fast; and how access is handed back if you change supplier. If you are choosing a new partner, our guide to choosing a web development company in Australia covers contracts and handover in more depth.

Generative AI makes some attacks cheaper to run: more convincing phishing emails, fake invoices in your suppliers' style, cloned login pages and faster scanning for known vulnerabilities. We have not found an ASD figure that measures how much of the Australian picture is AI-driven, so we are not quoting one.

What does not change is where the attacks land. Business email compromise and account takeover were already among the most reported business cybercrimes in ASD's factsheet, and the defences are the same ones above: phishing-resistant sign-in, a rule that bank detail changes are confirmed by phone on a known number, least privilege and fast patching.

If your website has an AI chatbot or assistant, treat it as a new attack surface. Prompt injection is the first item in the OWASP Top 10 for LLM Applications 2025, and an assistant connected to orders, bookings or customer records should have the narrowest permissions possible. Our guides to AI security for business applications and AI governance in Australia cover the controls, and AI automation in Australia covers where such tools fit.

Security is mostly routine work done on time. The calendar below is our recommendation for a typical small business website; raise the frequency for online stores, portals and sites holding health or financial information. Many tasks overlap with the website maintenance guide, so run them together.

These are illustrative composites, not ZSpace clients or real businesses.

Hypothetical example 1: an allied health clinic with online bookings. A clinic with turnover well under AUD 3 million takes bookings through its website and stores intake forms. Because it provides a health service and holds health information, the NDB scheme can apply even though it is a small business, according to the OAIC. It moves intake forms into its practice management system rather than the website database, turns on passkeys for the two staff who administer the site, confirms where the booking tool stores data, and adds the OAIC's eligible-breach test to its runbook.

Hypothetical example 2: an online retailer over the threshold. A homewares store on a hosted ecommerce platform has turnover above AUD 3 million. Its main risks are admin account takeover and third-party scripts on checkout. It enforces MFA for every staff and agency account, removes four unused apps, keeps payment on the provider's hosted checkout to limit card-data exposure, and records in its runbook that any ransom payment must be reported to ASD within 72 hours. See ecommerce security and Shopify development in Australia for store-specific controls.

Hypothetical example 3: a trades business with an ageing site. A plumbing company's WordPress site runs on PHP 8.1, which is end of life. The developer who built it has moved on, and nobody knows the hosting login. The first job is not a redesign: it is recovering ownership of the domain and hosting accounts, enabling MFA, taking a backup, upgrading PHP on a staging copy and removing abandoned plugins. Only then is it worth deciding whether to rebuild.

Security decisions sit inside wider website and software work. If you are building or rebuilding, our digital product development guide for Australia shows where security fits in a product roadmap, and custom software development in Australia and SaaS development in Australia cover the extra controls portals and multi-tenant products need. Every integration adds an attack surface, so read website API integration, ecommerce webhooks and payment gateway integration alongside this guide. If a CRM or AI tool is connected to your site, see CRM website integration and enterprise AI integration.

Security and accessibility reviews are often scheduled together because both touch forms, logins and third-party scripts. Our website accessibility guide for Australia covers the accessibility side.

ASD and ACSC: Annual Cyber Threat Report 2024–25 factsheet for businesses and organisations; Essential Eight Maturity Model (November 2023); Report a cybercrime or incident; Questions to ask managed service providers.

Legal obligations: Home Affairs, ransomware payment reporting factsheet; OAIC, when to report a data breach; OAIC, Part 4: Notifiable Data Breach scheme; OAIC, 2025 NDB statistics; OAIC, APP 8 guidelines.

Technical references: FIDO Alliance, passkeys; OWASP Top 10:2025; OWASP Logging Cheat Sheet; OWASP Top 10 for LLM Applications 2025; NIST CSF 2.0; PHP supported versions; Node.js releases; Google Search Console Security Issues report.

Checked 9 October 2026. Rules, thresholds and support dates change; re-check before relying on them. Nothing here is ZSpace client data or legal advice.

Website security for an Australian small business is not a product you buy once. It is a short set of controls (MFA and passkeys, timely patching, least privilege, isolated and tested backups, monitoring) kept up on a calendar, plus a clear view of which legal duties apply to you and a runbook for when something goes wrong. The Essential Eight gives you a familiar structure for the first part; the OAIC and Home Affairs set the rules for the second.

Start with the accounts that control your site, check your runtime versions against the dates above, and write the one-page runbook this month. Those three steps close more risk than any single tool.