Security for Any Small Site: 6 Steps Before You Ship

Security is not something that happens after stabilisation — it is a set of decisions made on day one. These steps are not advanced, but they stop most problems that hit small sites.

1) Never store a secret in the code

API keys, tokens and passwords never belong in site files. Anyone can open the source and see them — and even if you delete them later, they remain in the file history.

Use environment variables on your hosting platform. Most leaks are not caused by a clever hacker, but by a token committed by accident.

2) Set security headers

• X-Content-Type-Options: nosniff — stops the browser guessing file types.
• Referrer-Policy — do not send internal URLs to other sites.
• Content-Security-Policy — defines where scripts may come from (strongest, hardest to configure).

3) Force HTTPS

Free on most modern platforms. Without it, anything sent (forms, email, passwords) is exposed on the network.

4) Sanitise anything the user inputs

Anything a user types that is rendered back into the page is an XSS risk. The rule: render it as text, not as HTML. In most cases that is one line, and it prevents a serious problem.

5) Take a backup before any big change

Not every "hack" is a hack — sometimes you break it yourself. A backup is the cheapest insurance there is: a copy of files, a copy of data, both off the server.

6) Update what you depend on

Old libraries carry published, known vulnerabilities. You do not need to be on the newest release always, but read security releases and apply them. Priority: anything that accepts user input.

The last piece of advice

The goal is not to be unhackable — the goal is to be expensive to attack and unable to lose everything. These six steps do both, at roughly zero cost.

And if you have a form storing user data — that is the highest-risk point on any small site. Treat it more seriously than anything else here.