Website Security Basics for Small Businesses and Clinics

A "Not secure" warning is a rough first impression. Someone came to call you or check your hours, and the warning makes the site look untrustworthy before they read a word. A few basics prevent most of those warnings. You do not need a scare story.

This is general information for shops, offices, and clinics. It is not a report on any one website, and it is not legal advice.

What the warning is telling people

Browsers show "Not secure" when the connection is not protected by a current certificate. Sometimes the certificate expired. Sometimes nobody installed one. Sometimes the site still sends visitors to an old address that does not have one.

Clearing the warning is ordinary upkeep. Someone installs or renews the certificate so the browser can show a secure connection. It is one job, not a standing plan, and JD quotes it after a short call. Other website help is described on the services page. This site does not publish a price list.

A certificate has to be renewed

Someone has to install the certificate and renew it before it expires. A quiet expiration is a common reason a site that was fine last month shows a warning this month.

If D3 hosts the site, hosting can include the certificate, backups, and security updates. A care arrangement can add software updates and a little time for content edits. Unused time on that kind of plan does not roll over. JD writes the quote before any of that starts.

If another company hosts the site, ask who renews the certificate and write the answer down. How this fits a new 1 to 3 page site is in What a starter website includes.

Keep the software current

The certificate is only one piece. The software the site runs on, and any themes, plugins, or add-ons, need updates. Old add-ons are a common weak spot. You do not have to follow security news. You do need someone, or a plan, that applies updates on a schedule you understand. Delete add-ons you do not use, and install updates from the original source, not from a random download.

If you are not sure what the site is running, ask whoever built it, or ask JD. A website snapshot on this site reads the public homepage and can point out a missing secure connection. It does not look for malware, and it does not log in to your site. If you think someone else changed the site, say that when you write. Do not keep typing the password into a page you no longer trust.

Passwords and old logins

• Use a long password you do not also use for email or Facebook.
• Turn on two-step sign-in when the software offers it. That second step, usually a code on your phone, blocks someone who only has the password.
• Remove accounts for staff who have left, and for helpers who no longer work on the site. Old accounts are easy to forget.
• Do not send the password in a text or an email other people can forward. If someone needs in, give them their own login and remove it when the job is done.

Backups, and who you call

A backup is a copy you can put back if an update breaks the site or the site is damaged. Know who makes the copy and how recent it is.

Hosting & Upkeep and the Website care plan both include backups. If you are on neither plan, ask the host for the date of the last copy. If nobody has one, close that gap first.

If a warning is on the screen, email JD or use the contact page. Existing clients can use the support address at the end of this article. Tell us the site address and what the browser says. A screenshot is enough if you have one.

A note for clinics

Clinics have extra privacy rules. People often call those rules HIPAA. Check with your compliance advisor before you collect anything about a patient on a website. Do not put patient details in a form, a chat box, or a page the public can read. A contact section can show the office phone and a general email. It should not ask for symptoms, test results, or insurance numbers.

Nothing in this article makes a clinic compliant, and D3 does not decide what those rules require. Your compliance advisor does. A current certificate is still worth having. It is not a stand-in for that advice.

Keep health details off your Google listing too. How local customers find you on Google covers the profile.