A valid SSL certificate, regularly updated software and dependencies, and strong administrative access controls form the baseline for most small business websites. Automated backups are equally important, since they determine how quickly a site can recover if something does go wrong.
Form submissions should be validated on both the browser and the server, and spam-protection measures should be in place to reduce automated abuse. Where customer data is collected, it should be handled in line with applicable privacy obligations.
Ongoing monitoring — checking for outdated plugins, broken links and unusual activity — is what keeps a secure launch from quietly becoming an insecure website twelve months later.