Website speed and security

Speed and security are the parts of a website nobody notices until they go wrong. A page that takes too long to appear loses visitors before they read a word, and a site that isn’t kept up to date can be exploited, defaced or taken offline. For a small Perth business, both are usually fixable with routine maintenance rather than a rebuild.

This article explains what slows a site down, why small businesses are not too small to be targeted, and the practical steps worth checking now.

Why speed matters

Visitors judge a site by how quickly it responds. If a page is slow, particularly on a phone connection, many people give up and go back to the search results, often straight to a competitor.

Speed also affects search. Google uses page experience signals, including its Core Web Vitals measurements of loading, responsiveness and visual stability, as part of how it evaluates pages. A slow site isn’t only frustrating; it can make you harder to find.

You can check your own site for free with Google’s PageSpeed Insights, which reports these measurements and suggests improvements.

What usually slows a website down

The most common causes are consistent across small business sites:

• Oversized images. Photos uploaded straight from a camera or phone are often many times larger than the space they’re displayed in.
• Too many plugins or scripts. Each adds weight, and some load on every page whether they’re needed or not.
• Heavy themes and page builders that ship far more code than the page uses.
• Underpowered hosting, or hosting located far from your customers.
• No caching, so the server rebuilds the same page for every visitor.

Most of these can be addressed by resizing and compressing images, removing what isn’t used, enabling caching and choosing appropriate hosting.

Why small businesses are targets

It’s common to assume a small business website isn’t worth attacking. In practice, many attacks are automated: software scans huge numbers of sites looking for known weaknesses, such as outdated plugins or weak passwords. A site isn’t chosen because the business is important; it’s found because it’s vulnerable.

The consequences can include:

• Customer information being exposed
• The site being defaced, redirected to spam, or used to spread malware
• Browsers or search engines warning visitors away
• Time and cost to clean up and restore

The Australian Cyber Security Centre publishes practical guidance for small businesses at cyber.gov.au, which is a good starting point.

The basics of keeping a site secure

• Use HTTPS. A valid certificate encrypts traffic between your site and visitors, and browsers flag sites without it as “Not secure”.
• Keep software updated. For content-managed sites, that means the core system, themes and plugins. Updates frequently fix security issues.
• Remove what you don’t use. Inactive plugins and old admin accounts are unnecessary risk.
• Use strong, unique passwords and multi-factor authentication on every account with access to the site, hosting and domain.
• Limit who has access, and remove people who no longer need it.

Backups: the step most businesses skip

A backup is what lets you recover from a failed update, a mistake or an attack without starting again. A useful backup setup is:

• Automatic, rather than relying on someone remembering
• Stored separately from the website itself, so a problem with the site doesn’t take the backups with it
• Tested, because a backup that has never been restored is an assumption rather than a safeguard

Taking a backup immediately before any significant update is also worth making routine.

What to check today

1. Run your homepage through PageSpeed Insights and note the largest issues.
2. Confirm the site loads over HTTPS with no browser warning.
3. Check when the site’s software was last updated.
4. Find out where your backups are stored, and when one was last restored.

If you’d rather have this handled for you on an ongoing basis, see our website care and hosting service.