Website security basics every practice owner should check

01What are the four website security basics to check first?

Most website security advice for small businesses comes down to four habits: force HTTPS everywhere, keep software patched, control admin access, and back up data on a schedule you actually test. CISA built its small business guidance around these same points, because most breaches happen through default passwords, unpatched plugins and missing backups, not exotic attacks.¹ CISA's separate website security guidance adds detail: disable HTTP, patch critical vulnerabilities within 15 days and high-severity ones within 30 days, and keep backups you can actually restore from.² None of this needs a security certification. CISA notes the person running a small organization's security program does not need to be a security expert or an IT professional, just someone with the authority to keep the list moving.¹

02Is your site actually forcing HTTPS, not just offering it?

A padlock icon is not proof the whole site is secure. CISA's website security guidance says organizations should disable Hypertext Transfer Protocol (HTTP) entirely and enforce HTTPS plus HTTP Strict Transport Security (HSTS), preloading HSTS for the domain where possible.² In practice, every page, not just the booking form, should load over HTTPS, and old http links should redirect automatically instead of quietly loading mixed content. CISA also recommends monitoring certificate transparency logs and disabling older, weaker encryption methods such as SSLv2, SSLv3, 3DES and RC4.² If a developer set this up years ago, it is worth confirming HSTS is still enabled and that no page still serves plain HTTP, especially after a redesign.

03Who still has admin access to your website?

Attackers look for administrator accounts because one login opens everything. CISA points out that Microsoft has reported only 30 percent of Azure Active Directory global administrators use multi-factor authentication (MFA), even though admin accounts are the most valuable target in an organization.¹ CISA's small business guidance recommends enabling MFA on all admin accounts and removing admin privileges from everyday user laptops, since a user without admin rights cannot install software.¹ Its website security guidance repeats this: enforce MFA on internet-accessible accounts, prioritize privileged ones, and apply least privilege by disabling accounts nobody uses.² For a practice, that means checking who can log into the content management system, since a former employee or past contractor should not still have a working password. For the privacy side of online forms, see online patient intake forms and which tools need a BAA.

04Are your backups backups, or just hopes?

CISA notes that many organizations hit by ransomware either had no backups or had backups that turned out incomplete or damaged when needed.¹ A backup never restored from is not a verified backup. CISA's website security guidance recommends a solution that automatically backs up site data and configurations, stores copies in a safe, physically remote location, and tests disaster recovery scenarios rather than assuming the backup job ran.² For a small practice, that can mean asking your host or developer what gets backed up, how often, where it lives, and the last time anyone actually restored from it.

05What does HHS expect a small healthcare practice to do?

The U.S. Department of Health and Human Services runs the 405(d) Program, a collaborative effort between the Health Sector Coordinating Council and the federal government to align cybersecurity practices across the healthcare and public health sector.³ Its flagship resource, Health Industry Cybersecurity Practices (HICP), aims to raise awareness and strengthen the sector's cybersecurity posture.³ The program describes itself in terms of awareness and alignment rather than enforcement, so in practice it functions as voluntary guidance: it will not replace a formal compliance review, but it gives a compliance adviser a recognized framework to measure your practice against.

06Does the FTC Safeguards Rule apply to your practice?

Probably not directly. The FTC's Safeguards Rule applies to non-banking financial institutions, such as mortgage brokers, motor vehicle dealers and payday lenders, under the Gramm-Leach-Bliley Act.⁴ The rule's own description does not mention health or wellness practices, so most practices are unlikely to fall under it directly; a practice that extends its own financing to patients should still check with an attorney about whether any part of the rule reaches its situation, since that is a legal question specific to your state and setup. Even without a direct obligation, the rule's content is a useful benchmark: access controls reviewed regularly, MFA for anyone accessing sensitive information, encryption where feasible, and a written incident response plan.⁵ The FTC's 2023 amendment also requires covered institutions to report a breach affecting 500 or more people within 30 days of discovery, a reasonable yardstick for how fast any organization should act.⁶

07What are the most common mistakes practices make here?

• Treating the padlock icon as proof the whole site is secure, when one unencrypted page can still expose a message from a patient.
• Leaving a developer's or former employee's login active long after the job ended.
• Backing up the database but forgetting site files, images or plugin settings.
• Assuming a HIPAA-compliant intake form covers the whole website, when the two are usually secured separately.

This week, ask whoever manages your website three things: does every page load over HTTPS, who still has admin access, and when someone last restored a backup rather than just checked it exists. A free credibility check can flag the basics for you.