Website Security: Why Pay for What Cloudflare Gives You Free?
Quick Answer: Website security for a business comes down to five things: encryption on every connection, protection at the edge against attacks and bad bots, a domain nobody can steal, accounts only you control, and a way back when something breaks. Cloudflare and modern hosts like Vercel give you most of that for free. What's worth paying for is the expertise to set it up right, and the work that turns a safe site into revenue.
You run a business. You have a website. And every few weeks, somebody tells you it isn't safe.
Maybe it's an email about a "security plan." Maybe your host offers a malware scanner for a monthly fee, or an agency adds a "protection package" to the invoice. You can't tell which of these matter, so you either pay for all of them or ignore all of them. Both feel bad.
I get it. My first website went live in 1998, and I spent a big part of the years since on the infrastructure side of the internet, in datacentres and government server rooms. I know this stuff cold. And I still got hacked.
So this is the article I wish someone had handed me before that happened. It covers what website security actually is, how attacks really reach small businesses, what Cloudflare gives every business for free, how Cloudflare and Vercel fit together, and what encryption really protects.
It also covers where your money should go instead. It's long, because the topic deserves it and because the short versions are how people end up paying twice. Grab a coffee.
I got hacked with a security plugin installed
Here's the part I don't usually lead with.
I came to websites from the infrastructure side. At Toronto Hydro I worked on a datacentre migration, with VMware clusters, storage area networks and WebLogic and WebSphere middleware. At the Ontario Public Service I did middleware deployments for the province.
I'm a VMware Certified Professional. Servers didn't scare me.
When I started my own company in Mississauga (it began as Orbitux and became OrbitWeb Inc. in February 2017), I built a hosting platform for my clients' WordPress sites on AWS. The servers, the hosting and the security were all mine. I protected it with a popular WordPress security plugin suite and followed every recommendation it made.
It got hacked anyway.
I had three or four paying clients back then, and the cleanup was painful and expensive. When your client list fits on one hand, every outage turns into a phone call you dread making.
I shut the platform down and moved my clients back to their own hosting. And I took away the lesson this whole article is built on: what sits under a website matters more than anything you bolt on top of it.
What the hack taught me
The plugin did what plugins do. It scanned files, sent warnings, and blocked the attacks it already knew about.
But a security tool you install on top of a site is still just more code on that site. It runs on your server, with your server's permissions. When that code, or any plugin sitting next to it, has a hole, your website has a hole.
I had added layers, and every layer was one more thing to update and one more door to watch.
The numbers say I wasn't unlucky. Verizon's 2026 Data Breach Investigations Report found that 31% of breaches now start with an exploited software vulnerability, ahead of stolen passwords. Verizon's own summary says attackers are shifting their focus from tricking people to exploiting systems.
Every plugin, theme and add-on you run is part of the surface they're going after.
Security comes from how the whole thing is built: what's exposed to the internet, who holds the keys, what's encrypted, and how fast you can get back to a clean copy when something goes wrong. That's the idea this whole article keeps coming back to.
That means fewer moving parts, real encryption, keys you hold yourself, and protection that sits in front of your site instead of inside it.
What website security actually means for a business
Website security is the set of protections that keep your site online, keep your visitors' information private, and stop strangers from changing your site or taking it from you. That's the plain definition.
For a business, I break it into five layers. If you understand these five, you can judge any security pitch in about a minute.
1. Encryption on every connection
When someone fills in your contact form, their name and phone number travel across networks you don't control. HTTPS encrypts that trip with TLS, the protocol behind the padlock in the address bar. Without it, anyone on the same coffee-shop Wi-Fi can read or change what gets sent.
Google turned this into a business issue years ago. In August 2014 it announced HTTPS as a ranking signal. In February 2018 it announced that Chrome would mark every plain-HTTP site as "not secure," starting with Chrome 68 that July (Google Security Blog).
Today a site without HTTPS loses a visitor's trust before they read a word.
The padlock only describes one part of the trip, though. I'll come back to that, because it's exactly where a lot of "secure" websites quietly aren't.
2. Protection at the edge
The edge is the network that sits between the internet and your website. A good edge does three jobs.
It absorbs floods of fake traffic, which is what a DDoS attack is. It filters known attacks with a web application firewall, a WAF, which inspects each request and blocks the ones trying to sneak commands into your forms or address bar. And it slows down bad bots before they reach anything that matters.
The key word is before. If the first thing an attacker touches is your server, you're defending in the worst possible place, on the one machine that can least afford to be busy. If the first thing they touch is a global network built to soak up attacks, your site never feels it.
This is also why I like websites that ship as finished pages instead of running a stack of plugins on every visit. A page that's already built has nothing to exploit at the moment someone loads it. Less code facing the internet means fewer doors.
3. A domain nobody can steal
Your domain is the most valuable thing you own online. Your website, your email and your reputation all hang off it. If someone takes control of it, they don't need to hack your website at all. They point your domain somewhere else, catch your email, and wait.
Domain security is boring, and it matters more than anything else on this list. You want four things: a registrar lock that blocks transfers until you remove it, a recovery email that only you control, two-factor authentication on the registrar account, and DNSSEC.
DNSSEC signs your domain's DNS answers, so nobody can quietly forge where your domain points.
Your email rides on your domain too. Three DNS records, called SPF, DKIM and DMARC, tell the world which servers are allowed to send mail as your business. Without them, anyone can send an email that looks like it came from you, to your own customers.
Here's what each one does, in plain words. SPF lists the servers allowed to send mail for your domain. DKIM signs each message, so the receiving server can check it wasn't changed on the way. DMARC tells receiving servers what to do with mail that fails those checks, and sends you reports about who's trying to use your name.
Most owners have never heard of those three records. Most attackers have.
And there's a revenue side to this. Mail from a domain without them is more likely to land in spam, including your quotes, your invoices and your replies to new leads.
4. Accounts and keys only you control
Most break-ins don't start with genius. They start with a password that was reused, shared or phished.
Microsoft found years ago that multi-factor authentication "can block over 99.9 percent of account compromise attacks" (Microsoft Security Blog, August 2019). That one setting, turned on for your email, registrar, DNS and hosting accounts, does more for a small business than any paid scanner I've seen.
Keys matter just as much as passwords. Every login you hand out is another way in. Give people their own accounts with the least access they need, and remove them when the work is done.
If three people know the same password, you have three doors and no idea which one was used.
5. A way back
Something will go wrong eventually. A bad edit, a broken update, a mistake at eleven at night. Security includes recovery: versions you can roll back to, and a copy of your website that belongs to you.
If the only copy of your website lives inside someone else's account, in a format you can't take with you, you don't fully own it. You're renting, and the landlord holds the keys.
The simplest backup rule I know is three, two, one. Keep three copies of anything you can't afford to lose, on two different kinds of storage, with one copy somewhere other than the server it protects. For a website, that means the live site, the versions your platform keeps, and a copy you hold yourself.
And test the restore once. A backup you've never restored is just a hope.
That's the whole map. Before we get to the good news, let's look at how attacks actually arrive.
How attacks actually reach a small business website
Here's the thing most owners get wrong. They picture a hacker in a hoodie choosing their business. That almost never happens.
Your site gets found by software that scans the whole internet, all day, looking for anything with a known weakness. To that software, your website is just a match for a pattern. It doesn't care that you're a three-person clinic in Guelph.
These are the common paths in, and the layer that blocks each one.
The old plugin
A plugin, theme or add-on with a known hole is the easiest way in. Once a weakness is public, scanners start trying it on every site they can find. That's the 31% in Verizon's report.
What stops it: fewer plugins, updates the week they ship, and a WAF in front that blocks the common exploits before they reach your server. Cloudflare's Free Managed Ruleset exists for exactly this.
The reused password
Login pages get hammered with username and password pairs leaked from other websites. If your admin password ever leaked anywhere and you reused it, somebody will try it on your site eventually.
What stops it: a unique password from a password manager, multi-factor authentication on every admin login, and a challenge on the login page so bots give up. Cloudflare's Turnstile does that for free.
The fake email
Phishing aimed at small businesses looks boring on purpose: "your domain is expiring," "unusual sign-in on your hosting account," "your invoice is attached." The goal is your registrar, email or hosting login.
What stops it: never clicking those links, and multi-factor authentication, so a stolen password alone isn't enough to get in.
The forgotten domain
Domains get lost two ways. Somebody takes over the registrar account, or the renewal fails and the domain expires.
Either way, your website and your email stop working at the same moment. Getting them back takes weeks when it works at all.
What stops it: the registrar lock, auto-renew on a card that won't expire next month, a recovery email you actually read, and two-factor authentication.
The flood
A DDoS attack sends more traffic than your server can answer, so real customers can't get in. It doesn't take a big attack to knock over a small server on shared hosting.
What stops it: an edge network in front of your site. Cloudflare and Vercel both include DDoS mitigation on every plan, including the free ones.
The script you didn't write
Most business websites load code from other companies: chat widgets, analytics, booking tools, ad pixels. Each one runs inside your visitors' browsers with the same access as your own code. If one of those companies gets compromised, your website serves the attacker's code to your customers.
What stops it: loading fewer third-party scripts, removing the ones nobody uses, and preferring tools that run on your own domain.
The fake lead
Bots fill in contact forms with spam, fake quote requests and links to places you'd never click. It wastes your time, and it pollutes the numbers you use to decide where to spend money.
What stops it: a challenge like Turnstile on your forms, and a system that checks leads before they reach your phone.
See what all of those fixes have in common? Almost every one of them is free, and none of them needs a tool living inside your website.
What is Cloudflare? The free layer under a fifth of the web
Cloudflare is a global network that sits in front of websites. It answers DNS lookups for your domain, serves and caches your pages from data centres near your visitors, and filters attacks before they reach your server. In technical terms, it's a reverse proxy, a CDN and a DNS provider in one account.
It's big. Cloudflare's network page lists 348 cities, and says 95% of the world's Internet-connected population is within 50 milliseconds of one of its data centres. Cloudflare says it powers 1 in 5 sites on the internet.
Independent numbers go further. As of October 2026, W3Techs reports that Cloudflare is used by 27.6% of all websites, and by 85.9% of the websites whose reverse proxy service it can identify.
I'm not quoting those numbers to sell you on Cloudflare. I'm quoting them so you understand what "free" means here. On the free plan you sit on the same network that protects a large share of the web, behind the same edge, learning from the same attack traffic.
How Cloudflare works, in one minute
When someone types your domain, their device asks DNS where your website lives. With Cloudflare as your DNS, Cloudflare answers.
If the record is proxied, the answer points to Cloudflare's own network instead of your server. The visitor connects to the nearest Cloudflare data centre, where the request gets checked against firewall rules and bot signals.
If Cloudflare has a cached copy of the page, it serves it right there. Only the requests that need your server get passed along, and your server's real address stays hidden behind Cloudflare the whole time.
Is Cloudflare free? What the free plan actually gives you
Yes, and it's a real product, not a trial. Cloudflare says plainly that "every website should have free access to foundational security and performance." Here's what you get at no cost, with Cloudflare's own documentation as the source:
- DNS for your domain on Cloudflare's global network, with one-click DNSSEC.
- Free SSL certificates, so HTTPS works without buying a certificate from anyone.
- Unmetered DDoS protection. Cloudflare's DDoS documentation says it provides "unmetered and unlimited distributed denial-of-service (DDoS) protection at layers 3, 4, and 7 to all customers on all plans and services."
- A web application firewall. The Cloudflare Free Managed Ruleset is "available on all Cloudflare plans" and "provides protection against high-impact and widely exploited vulnerabilities" (WAF managed rules). You also get 5 custom WAF rules on the free plan (custom rules).
- Bot Fight Mode, which challenges common bad bots.
- Turnstile, Cloudflare's free alternative to the "click every traffic light" CAPTCHA, for your forms and login pages.
- Web Analytics that doesn't need cookies.
- Email Routing, so hello@yourbusiness.com can forward to the inbox you already use.
- AI Crawl Control, "available on all plans," which shows which AI crawlers visit your site and lets you allow or block each one (AI Crawl Control).
- Cloudflare Registrar, where "registration, transfer, and renewal prices are always at or below what registries and ICANN charge us." In Cloudflare's words, it "does not mark up domain prices at all." Your domains "stay locked to help prevent unauthorized transfers," with free WHOIS redaction to keep your personal details out of public records (Cloudflare Registrar). And for Canadian businesses, .ca is now on its list of supported domains.
Yep, all of that, for free.
Read that list again and think about your last few invoices. Plenty of agencies and hosts bill monthly for items on it: the SSL certificate, the "DDoS protection," the basic firewall, the domain renewal with a markup. You can get every one of those straight from the source.
That's the whole reason this article exists. Once you know what's free, you can judge everything else.
Running more than one website?
If you look after several websites, for your own businesses or for clients, Cloudflare scales with you at no cost. Every domain gets its own free plan and its own settings, and they all sit in one account and one dashboard. You can see traffic, blocked threats and AI crawler activity for each domain, and change any of it in a few clicks.
Add the people who help you as members of the account instead of handing out your login. When someone leaves, you remove them, and every domain stays yours.
The AI crawler switch
One item on that list deserves its own section, because it's new and it touches your revenue.
On July 1, 2025, Cloudflare changed its default to block AI crawlers on new domains unless they pay creators for the content (Cloudflare blog). It backed the change with numbers about how lopsided the trade had become.
By Cloudflare's count, getting traffic back from OpenAI was 750 times more difficult than it was with the Google of old. Getting it back from Anthropic was 30,000 times more difficult.
Whether you block AI crawlers is a business decision, not a security reflex. If you want ChatGPT, Claude or Perplexity to recommend your business, blocking every AI crawler works against you. If you'd rather keep your work out of training data, now you can.
The point is that the switch is yours, and on Cloudflare it costs nothing to flip.
How to decide which AI crawlers to allow
Here's how I think about it. AI companies send two kinds of bots. Some collect pages to train future models. Others fetch pages live, to answer a question somebody just asked, and those are the ones that can send you a customer.
If your business runs on being recommended, you want the answer bots to read you. If your content is the product, like a paid course or original research, you have good reasons to block the training bots. AI Crawl Control shows you which crawlers visit, how often, and which ones follow your robots.txt, so you can decide one crawler at a time.
You also want the ones you allow to understand you. That's why I care about llms.txt, a plain-language file that tells AI assistants what your business does, and about structured data, which gives search engines and AI the same facts in a format they can read without guessing. WebCore writes both on every publish.
What Cloudflare can't do for you
I promised honesty, so here it is. Cloudflare is infrastructure. It isn't magic.
It can go down. On November 18, 2025, a database permissions change inside Cloudflare caused a feature file to double in size and broke a large part of its network from 11:20 to 17:06 UTC (Cloudflare's post-mortem). A big share of the internet returned errors for hours.
Cloudflare's CEO wrote that a period where the network "was not able to route traffic is deeply painful to every member of our team." Any single provider can fail, and that's worth knowing before you put everything behind one.
It can also give you a false sense of safety. Cloudflare's "Flexible" SSL mode puts a padlock in your visitor's browser while the connection from Cloudflare to your server stays unencrypted.
Cloudflare's own SSL documentation says that in Flexible mode, traffic from visitors to Cloudflare can be encrypted, "but traffic from Cloudflare to the origin server is not." Cloudflare "strongly recommends using Full or Full (strict) modes."
The padlock tells you the first half of the road is private. It says nothing about the second half.
And Cloudflare doesn't fix what's behind it. It won't back up your website, update an old plugin, or stop someone who logs in with your reused password. That part is still on you, or on whoever builds and runs your site.
Do you need Cloudflare for your website? My honest answer
Yes, for your domain and DNS at the very least, whatever you build on and whoever builds it. I'd tell you that even if you never become a client. Use it because it helps.
The more interesting question is how much of Cloudflare to switch on. That depends on where your website lives.
Two ways to use Cloudflare
Every DNS record on Cloudflare has a switch with two positions. Cloudflare calls them proxied, shown as an orange cloud, and DNS only, shown as a grey cloud.
Proxied means your visitors connect to Cloudflare, and Cloudflare connects to your server on their behalf. You get Cloudflare's caching, firewall and DDoS protection in the path of every request.
DNS only means Cloudflare just answers one question, "where does this domain live?", and your visitors connect straight to your host. You keep Cloudflare's fast DNS, DNSSEC, the registrar lock and Email Routing. You just don't put its proxy in the path.
When to proxy, and when not to
If your website sits on basic shared hosting with no protection of its own, proxy it. Cloudflare becomes your edge, and you're far better off than with nothing at all.
If your host already runs a serious edge network with its own firewall and DDoS protection, a second proxy in front tends to make things worse. Vercel, which I'll get to in a moment, says so in its own guide: "We recommend connecting directly where possible," because "an external proxy introduces security, caching, and operational tradeoffs" (Vercel).
Two firewalls looking at the same visitor give you double the confusion and no extra protection. Pick the one that sees the real visitor, and let it do its job.
What happens when you move your DNS to Cloudflare
Moving DNS sounds scarier than it is, so here's what actually happens.
You add your domain to a free Cloudflare account. Cloudflare scans your current DNS records and copies them over: your website's address, your email's MX records, and the TXT records other services use to verify you. You check that list against what you had before, line by line.
Then Cloudflare gives you two nameservers. At your current registrar, you replace the old nameservers with Cloudflare's. That's the whole switch.
The change spreads across the internet over the next few hours, often faster. During that window, some visitors reach the old DNS and some reach the new one. That's fine as long as both point to the same places, which is exactly why you copy everything first.
After the switch, test three things. Your website loads over HTTPS. An email from an outside address reaches your inbox. Any form on your site still delivers.
If email stops, an MX record didn't come across, and you add it back in a minute.
Kind of anticlimactic, honestly. That's how it should be.
The setup I recommend for any business
1. Move your domain to Cloudflare Registrar, or at least move its DNS to Cloudflare. You pay what the registry charges and nothing more.
2. Turn on two-factor authentication for your Cloudflare account, and make sure the account email is one only you control.
3. Keep the registrar lock on. Remove it only on the day you're deliberately moving the domain.
4. Turn on DNSSEC. It's one click.
5. Add SPF, DKIM and DMARC records for your email, using the values your email provider gives you.
6. Set up Email Routing if you want branded addresses without paying for another mailbox.
7. If you proxy, set SSL/TLS to Full (strict), never Flexible, and turn on Always Use HTTPS.
8. If you proxy, switch on Bot Fight Mode and keep the free managed WAF rules active.
9. Choose your AI crawler policy in AI Crawl Control on purpose, instead of leaving it to whatever the default was the day you signed up.
10. If your host has its own edge, like Vercel, set those records to DNS only and copy the DNS values your host shows you exactly.
11. Write down where everything lives: registrar, DNS, host, email, and who has access to each one. Future you will be grateful.
That's about an hour of work. For most small businesses, it covers more than the paid "security packages" I see on invoices.
Running WordPress? Start with these six fixes
WordPress runs a huge share of business websites, and it's where I learned my most expensive lesson. You don't have to leave it to be safer. Nah, you just have to look after it. Here's where I'd start this month:
1. Delete what you don't use. Every deactivated plugin and unused theme still sits on the server, waiting for its next vulnerability. If it isn't running your site, remove it.
2. Update on a schedule. Pick a day each week. Updates close the exact holes scanners look for. If your site is fragile, test on a copy first.
3. Lock the login. Use a unique admin username, a long unique password, multi-factor authentication, and a challenge like Turnstile on the login form.
4. Put Cloudflare's proxy in front. On shared hosting, this is your edge: DDoS protection, the free managed WAF rules and Bot Fight Mode, all before a request touches your server. Set SSL to Full (strict).
5. Keep backups somewhere else. A backup stored on the same server as the site disappears with the site. Keep copies off the server, and test a restore at least once.
6. Ask who has access. List every admin account. Remove the agency you stopped working with three years ago, and the intern from last summer.
And be honest about the tradeoff. Every one of those steps is ongoing work, forever, because the platform runs code on every page view. That ongoing work is the real price of the platform, and it's worth knowing before you choose it. If you're weighing that price, I've written about the real cost of a cheap website.
Cloudflare and Vercel: why I run both
WebCore sites run on Vercel, and their domains can sit on Cloudflare. People ask why I'd use both, so here's the honest version.
Vercel is a hosting platform built for modern websites and web apps. You push code, Vercel builds it, and it deploys to a global network. What matters most for this article is what Vercel puts in front of every site by default:
- Automatic DDoS mitigation. Vercel's firewall documentation says "DDoS Mitigation is available on all plans," and that its platform-wide firewall is "available for free for all customers without any configuration required."
- A web application firewall, also "available on all plans," with custom rules, IP blocking, managed rulesets and an Attack Mode for when you're under fire.
- Bot protection, which Vercel has announced as generally available.
- HTTPS everywhere. When I check webcore.pro's response headers, Vercel serves it with Strict-Transport-Security set for two years. That header tells browsers never to try plain HTTP with the site again, so nobody can quietly downgrade the connection.
So on a Vercel site, the edge already exists. That's why I use Cloudflare for what it does best (the domain, DNS, the registrar lock, DNSSEC, Email Routing) and let Vercel's edge handle the traffic, with the Cloudflare records set to DNS only.
Vercel lists its reasons for preferring a direct connection, and they're worth reading even if you never use Vercel. A proxy in front means "reduced security visibility," because Vercel stops seeing the real visitor. When many visitors share a proxy's addresses, "mitigation against malicious traffic from those addresses can also affect legitimate requests."
There's a caching problem too: "a deployment or cache invalidation on Vercel does not automatically update that external cache." So you can publish a fix and keep serving the broken version from somebody else's cache. Not fun.
One firewall, in the right place
Here's the detail most people miss. You want one firewall at the edge, and it needs to see the real visitor.
On a Vercel site, that's Vercel's firewall. On a site with no edge of its own, that's Cloudflare's.
Two firewalls stacked on top of each other don't double your protection. Actually, let me put that more precisely: they can double your blind spots, because the inner one sees every request arriving from the outer one and can't tell your customer from an attacker anymore.
So pick one, configure it, and actually look at it once in a while. A firewall nobody reads is a smoke detector with no battery.
Previews and rollbacks are security too
Every change on Vercel gets its own preview address before it goes live. You open it, you check it on your phone, and only then does it replace what your customers see. If a bad change slips through anyway, Vercel's instant rollback puts the last good version back.
I count that as security. A bad update with no way back takes a small business website down just as surely as an attacker does, and it doesn't need an attacker at all.
It's also why WebCore keeps recent versions of every site. A bad edit should cost you a click, not a weekend.
Why finished pages are harder to break
Many business websites still run on software that builds each page at the moment someone asks for it, with a database and a stack of plugins behind it. Every visit wakes all of that up, and every part of it is something an attacker can poke.
A site that's built ahead of time ships finished files instead. Vercel serves them from its edge. There's no plugin waiting on the server to be exploited, because no plugin runs when your page loads. The parts that truly need a server, like a contact form, run as small functions that each do one job.
That's how WebCore sites are built: each one is built ahead of time and served by Vercel, with the working parts kept small and separate. Good for speed, good for search engines and good for security, all from the same decision.
Workflows: the part that runs while you sleep
A lot of security happens in boring jobs that run on a schedule. Old versions get cleaned up. Tokens get refreshed before they expire. Somebody checks that what should be running is running.
Vercel handles this two ways. It runs scheduled jobs, and its Workflows product runs multi-step code "that can retry failed steps, wait for external events, and resume across crashes and deployments."
WebCore leans on Vercel's scheduled jobs for exactly this kind of work, and eight of them run on a timer. One cleans up old site versions every night. One refreshes store connections every three hours.
Another checks on trials every hour, and one re-measures the Ontario Trades Web Index every month. None of them need a person to remember.
The fine print on Vercel's free plan
Vercel's Hobby plan is free, and it's great for learning. But read the terms: "Hobby teams are restricted to non-commercial personal use only. All commercial usage of the platform requires either a Pro or Enterprise plan" (Vercel fair use guidelines).
Vercel counts "advertising the sale of a product or service" as commercial use. If your business website runs on a free hobby account, it's breaking the terms of the platform it depends on. Kind of a big deal when the platform is your storefront, and it's a risk most owners don't know they're carrying.
Encryption: the part a padlock doesn't show you
Encryption is the word every security pitch uses and almost nobody explains. Here's the thing: anyone can say the word. Far fewer people can tell you which data it covers. So let's explain it properly.
There are two kinds that matter for a business website, and they protect different things.
Encryption in transit protects data while it moves: from your visitor's phone to your website, from your website to its database, from your form to your inbox. That's TLS, the protocol behind HTTPS. The current version, TLS 1.3, was published by the IETF as RFC 8446 in August 2018.
Encryption at rest protects data where it sits: in a database, on a disk, in a backup. If someone copies the file, they get noise instead of names and numbers. The standard most systems use is AES, often in a mode called GCM that both hides the data and detects tampering. NIST describes it in Special Publication 800-38D.
The padlock only covers part of the road
Back to the padlock. It proves one thing: the connection between your visitor's browser and the first server it reaches is encrypted.
If that first server is a proxy in Flexible mode, the rest of the trip runs in the clear. If your contact form hands submissions to a plugin that emails them out over an unencrypted connection, the padlock knows nothing about it.
And if the data lands in a database where everything sits in plain text, the padlock was protecting a delivery to an open room.
So here are the three questions to ask about any website, including yours:
1. Is every hop encrypted, including the ones visitors never see?
2. Is HTTPS enforced with HSTS, so browsers can't be tricked into plain HTTP?
3. What's stored, where, and is the sensitive part encrypted?
HSTS, in plain English
Even with HTTPS, a visitor's very first request often starts as plain HTTP, the moment someone types your address without "https://" in front. That first moment is where a downgrade attack lives. Somebody on the same network grabs the plain request before your site can redirect it.
HSTS closes that gap. It tells browsers, after the first visit, to only ever use HTTPS for your domain. It's defined in RFC 6797, and on your end it's a single header.
Certificates that renew themselves
SSL certificates expire, and an expired certificate shows your visitors a full-page warning that scares them away. The old way meant buying a certificate every year and remembering to install it.
Today Cloudflare and Vercel issue and renew certificates automatically, for free. If anyone still bills you yearly for a basic certificate on a normal business website, ask them why. Nah, actually, just ask them to stop.
What "encrypted" should mean in practice
Here's what good looks like, in plain words:
- Passwords are never stored at all. They're hashed with an algorithm built for the job, like bcrypt, so even a stolen database doesn't reveal them.
- Secrets like API keys and tokens are encrypted at rest with a strong cipher, such as AES-256-GCM, and decrypted only at the moment they're used.
- Card numbers never touch your server. A hosted checkout, like Stripe's, handles them.
- Sign-in sessions live in cookies that scripts on the page can't read, which is what the httpOnly setting does.
How WebCore handles it, checked in the code
I'm going to be specific here, because vague security claims are how bad vendors get away with things. I checked each of these against WebCore's code before writing them down:
- When an organization brings its own AI provider key, WebCore encrypts it with AES-256-GCM before storing it. Telegram bot tokens and SHOPLINE store tokens get the same treatment.
- Passwords are hashed with bcrypt. Nobody at WebCore can read yours, and that includes me.
- WebCore subscriptions are paid through Stripe Checkout and Stripe's billing portal, so card numbers never touch WebCore's servers.
- Sign-in sessions are kept in httpOnly cookies.
- Every WebCore site is served by Vercel over HTTPS, with HSTS, and each site deploys as its own project on Vercel.
What about the information your forms collect?
The safest data is the data you never collected. Every field on your contact form is something you're now responsible for protecting.
Ask for what you need to call someone back and quote the job: a name, a way to reach them, and what they need. A form that asks for a birthday, a health detail or a card number makes you the keeper of something an attacker wants.
Then think about where submissions go. A form that emails the full contents to a shared inbox, and copies them into a spreadsheet three people can open, has spread your customers' details across places nobody is watching. One place, with access you control, is safer and easier to work from.
Here's a claim I'll never make, because it isn't true for anyone: that a website is "military-grade encrypted end to end." End to end describes messaging apps where only the two people talking hold the keys.
A website has a server in the middle by design, because the server is the website. When someone uses that phrase about a website, they're selling a feeling.
Hold your own keys: your domain, your accounts and your code
Encryption protects data. Keys protect everything else.
The question I'd ask about any provider, agency or tool is simple: who holds the keys? Everything below is a way of making sure the answer is you.
Your domain
Register your domain in your own name, in your own account. Not your web designer's account, and not your nephew's either.
A domain registered under somebody else's account becomes a hostage the day that relationship ends. And renewal notices that go to an inbox nobody reads are how businesses wake up to find their address parked with an ad page on it.
Cloudflare Registrar makes the safe version cheap: at-cost pricing, the transfer lock on by default, one-click DNSSEC and free WHOIS redaction. Put the domain there, under an email you control, with two-factor authentication on.
Your accounts
Turn on multi-factor authentication everywhere that matters. Start with email, because your email can reset every other password you own. Then the registrar, DNS, hosting and payments. Use an authenticator app or a security key rather than text messages where you can.
Never click a "password reset" or "your domain is expiring" link you didn't ask for. Open a new tab, go to the site yourself, and log in there. That one habit defeats most of the phishing aimed at small business owners.
Use a password manager, so every account gets a long, unique password you never have to remember. Reused passwords are how one leaked account turns into five. Share access through proper accounts, never through a text message or a sticky note on the monitor.
When someone needs access, invite them with their own login and the smallest role that does the job. When they're done, remove them. Shared passwords are doors you can't lock behind you.
A note for agencies and freelancers
If you build websites for clients, register each domain in the client's name and account, then ask them to add you with your own login. It can feel like giving up control. In practice it's what lets clients trust you with more work, because when the relationship ends, nobody's held hostage.
The same goes for hosting, analytics and email. Your client should own every account, and you should be a member of each one. When you hand a project over, hand over a written list of where everything lives, too.
Your code
This is the one people forget.
If your website only exists inside someone else's account, in a format you can't take with you, then you're renting. You can decorate a rental all you want. It's still not yours.
So ask every provider one question: "If I leave tomorrow, what do I walk away with?" The answer you want is "your domain, your content and your code." Anything else means your website stays behind when you go.
WebCore's answer is that you own the code. You can download your whole site as a ZIP from its settings, and your domain stays in your account. WebCore also keeps recent versions of every site, so a bad change is an undo instead of a disaster.
If you get hacked: what to do in the first hour
I hope you never need this section. I needed it once, so here it is, in order:
1. Take the site offline. Put up a maintenance page or pause the site at your host, so nobody gets served malware or a fake form while you work.
2. Change passwords from a clean device, starting with email. Your email can reset everything else, so it goes first. Then the registrar, DNS, hosting, the site's admin accounts and any payment accounts. Turn on multi-factor authentication as you go.
3. Check your domain. Log in to the registrar and make sure the domain is still yours, still locked, and still pointing where it should. If the DNS changed, that's where the attacker went first.
4. Look for new users and keys. Remove admin accounts you don't recognize, and replace any API keys or tokens the site uses, because whoever got in may have copied them.
5. Restore from a clean version. Go back to a version from before the attack, then apply updates before you bring it online. Restoring the same hole just invites the same visitor back.
6. Find out what was exposed. Contact forms, customer accounts, orders. If personal information leaked, it's a legal question as well as a technical one.
7. Write down what happened. When it started, what you saw, what you changed and when. You'll need it for your records and for your insurer, if you have one.
In Canada, that legal question has a clear answer. Under PIPEDA, a business must report a breach of security safeguards that creates a "real risk of significant harm" to the Office of the Privacy Commissioner, and notify the people affected "as soon as feasible." The law also requires you to keep records of all breaches of security safeguards for two years, whether you reported them or not (Office of the Privacy Commissioner of Canada).
Having this list in a drawer won't make an attack painless. It'll make the first hour shorter, and a lot calmer.
A 30-day website security plan
If the checklists above feel like a lot, spread them across a month. Here's the order I'd do it in, one short session a week.
Week 1: lock the doors that matter most
- Turn on multi-factor authentication for your email first, then your registrar, DNS, hosting and payment accounts.
- Move every password into a password manager, and change the ones you've reused.
- Check your domain: transfer lock on, auto-renew on, and a recovery email that's yours.
Week 2: put the edge in front
- Move your DNS to Cloudflare, copy every record, and test your email and forms after the switch.
- Turn on DNSSEC.
- If your host has no edge of its own, proxy the site through Cloudflare with SSL on Full (strict). If it does, like Vercel, set those records to DNS only.
Week 3: shrink what can be attacked
- Remove the plugins, themes and scripts nobody uses.
- Update everything that's left, and pick a day each week for updates.
- Add Turnstile to your forms and login pages.
- Add SPF, DKIM and DMARC records for your email.
Week 4: make sure you can get back
- Confirm your host keeps versions you can roll back to.
- Download a copy of your site and keep it somewhere you control.
- List every person with access to every account, and remove anyone who shouldn't be there.
- Put the first-hour plan from this article somewhere you'll find it on a bad day.
After that, it's upkeep: updates every week, an access review every quarter, and a look at your firewall and AI crawler reports once a month. Not much time, once the foundation is in.
Five website security myths that cost small businesses money
These five come up again and again, so let's clear them out.
"My site is too small to be attacked." The software that finds websites doesn't check your revenue first. It checks for weaknesses, and a small site with an old plugin is the easiest match it'll find all day.
"The padlock means my site is secure." The padlock means one connection is encrypted. Your domain, your accounts, your plugins and your backups are separate questions, and the padlock answers none of them.
"A security plugin keeps me safe." A plugin is more code running on your server. It can help, and I trusted one too. My server got hacked anyway.
"My web designer handles all of that." Maybe. Ask who holds the registrar login, when the last update ran, and where the backups live. If those answers take a week to arrive, you have your answer.
"Security is expensive." The foundation is mostly free, as you've seen. The expensive part is cleaning up after skipping it.
What website security can't do: grow your business
Here's the uncomfortable truth after all that. You can do everything above perfectly and still have a website that doesn't make you a dollar.
Security keeps the doors locked. It doesn't bring anyone to the door. So what does?
Years of running SEO and Google Ads for clients taught me what does move a business website: relevance, speed, and enough useful pages to be found for the searches that matter. Each one makes the others work harder, and the gains stack up over time. But only if somebody keeps working on the site.
Google builds that into its own ad system. Quality Score, which Google calls "a diagnostic tool," grades your ads partly on landing page experience: "how relevant and useful your landing page is to people who click your ad" (Google Ads Help).
What we found when we measured Ontario
In October 2026 we put 295 Ontario trades and clinics through Google's PageSpeed test, across 15 towns, on a simulated mid-range phone, for the Ontario Trades Web Index. Here's how they did:
- The median site took 6.8 seconds to show its main content. Google considers 2.5 seconds or less good.
- 92% of the sites took longer than three seconds.
- Only 9% reached the score of 90 that Google bands as good.
- 48% of 269 sites published none of the local business details a search engine can read.
None of those numbers would change with a better padlock. They change when somebody makes the site faster, clearer and easier for search engines to read.
Google's own guide to why speed matters shows what that costs: the BBC found it lost an additional 10% of users for every additional second its site took to load. Those are people your truck lettering, your referrals and your ads sent to the site, gone before your headline appears. (If speed is your problem, start with my speed guide for demanding businesses.)
A safe website that nobody finds is a locked brochure.
Speed and security come from the same place
Here's something the security pitch never mentions. The things that make a website safe are mostly the things that make it fast.
Fewer plugins means fewer holes and less code to load. An edge network close to your visitors blocks attacks and serves your pages from a few milliseconds away. Pages built ahead of time give attackers less to poke and give phones less to wait for.
You don't have to choose between safe and fast. Build the foundation right and you get both.
That gap, between a website that's safe and a website that earns, is the reason I built WebCore.
Where WebCore fits on top of Cloudflare and Vercel
So here's how the pieces fit together, in plain terms:
- Cloudflare holds your domain and answers for it. Registrar lock, DNSSEC, fast DNS, Email Routing and AI crawler controls. Use it whatever else you choose.
- Vercel serves your website from a global network, with its own firewall, DDoS mitigation and HTTPS enforced.
- WebCore is the AI website agent on top. It builds the site, keeps it fast and found, answers your visitors, and puts every lead in one place. And it does that work every day instead of once at launch.
Cloudflare and Vercel are a foundation I'd recommend to anyone. Putting WebCore on top of them is the part I'd call made in heaven, and I don't say that lightly.
What WebCore actually does
WebCore gives your business an AI for revenue, and the website is one of its tools. Here's what that means day to day:
- You talk to your own agent. You name it, and you talk to it in WebCore Studio or on Telegram, in plain words. It builds pages, edits copy and works through the task list you give it. Every conversation is kept, so you can scroll back through past work.
- It answers your visitors. A chat bubble on your website responds day and night. When a conversation turns into a lead, it lands in your Pipeline with the transcript attached, so you know exactly what the person asked before you call.
- It shows you what's working. The Visitors dashboard shows where people come from, what device they use, and which sources actually turn into leads.
- It gets you found. Every publish runs an SEO pass that writes the structured data search engines read, a sitemap, canonical addresses and an llms.txt file for AI assistants, plus crawler-ready pages for your articles that search engines can read without running any JavaScript.
- It writes with you. It helps you publish articles in your own voice, and it links each article to you as the author, so search engines and AI assistants know who wrote it.
- It keeps in touch for you. It sends newsletters, and it can turn a house photo into a listing page for a real estate agent.
- It works with your own AI. Any AI agent you already use can connect to your WebCore account with your organization's key, and it never publishes anything on its own.
- It runs on the stack this article describes. Each site is its own project on Vercel. Custom domains are attached and verified through Vercel. The AI provider keys and bot tokens you connect are encrypted with AES-256-GCM.
- You own the code. Plans start at $99 a month, and if you ever leave, your website leaves with you.
What happens at 9 p.m. on a Sunday
Here's the loop WebCore is built around.
A homeowner finds your website at 9 p.m. on a Sunday. Your phone is off, because you're a person. The chat bubble answers their question, asks what they need and how to reach them, and saves the whole conversation as a lead in your Pipeline.
Monday morning, you open the Pipeline, read exactly what they asked, and call them back already knowing the job. Then the Visitors dashboard shows you which source sent them, so you know what's worth paying for next month.
That's what I mean by an AI for revenue. The security underneath it is what lets you trust it with your customers.
Why the expertise matters more than the tools
Every tool in this article is available to anyone. Cloudflare's free plan is free for your competitor too. Vercel will host anybody who signs up tomorrow. Big deal.
The difference is knowing which switch to flip, in what order, and for what business reason.
That judgement is what twenty-eight years on the web buys you, more than half of them on the infrastructure side and the last ten helping small businesses turn websites into customers. WebCore puts that judgement into an agent that works on your site every day, instead of a report you read once a month.
What's worth paying for, and what isn't
Let's make this practical. Here's how I'd split a website security budget for a small business in 2026.
Free, straight from the source:
- SSL certificates, from Cloudflare or from your host.
- DDoS protection, which Cloudflare and Vercel both include on every plan.
- A basic web application firewall: Cloudflare's Free Managed Ruleset and 5 custom rules, or Vercel's WAF on any plan.
- DNS, DNSSEC, email forwarding, bot challenges and AI crawler controls, from Cloudflare.
At cost:
- Your domain, which Cloudflare Registrar sells at the price the registry charges.
Worth paying for:
- Commercial hosting, like Vercel Pro, because hobby tiers don't allow business use.
- Expertise: someone who sets the switches correctly and can explain why each one is set that way.
- Outcomes: leads, booked jobs and sales. Pay for work that moves revenue, not for a nicer view of protection you already have.
Red flags:
- A monthly fee for an SSL certificate.
- A "security package" that turns out to be a list of free Cloudflare features.
- Anyone who wants your own registrar or hosting login instead of their own access.
- Anyone who can't tell you exactly how you'd leave, and what you'd take with you.
Ten questions to ask anyone who sells you website security
Ask these out loud. A good provider answers every one in plain words, without getting defensive.
1. What does your service do that Cloudflare's free plan and my host don't already do?
2. Whose account is my domain registered in, and who can transfer it?
3. Is every hop encrypted, including the connection from your proxy to my server?
4. Is HSTS turned on for my domain?
5. Which of my secrets do you store, and are they encrypted at rest?
6. Who on your team can log in to my site, and where can I see that list?
7. How do I roll back a bad change, and how far back can I go?
8. If I leave, do I get my code, my content and my domain, and in what format?
9. What happens on your end during an outage, and how will I hear about it?
10. If my site gets hacked, what will you tell me, and how fast?
The first question matters most. If the answer to it is vague, keep your money.
Start with one hour this week
You don't need to become a security engineer. You need an hour and a list.
Open your domain registrar today and check three things: the transfer lock is on, the recovery email is yours, and two-factor authentication is on. Then move your DNS to Cloudflare, turn on DNSSEC, and add your SPF, DKIM and DMARC records.
That hour does more for your business than most paid security add-ons ever will. I learned all of this the expensive way, with three or four clients and a hacked server. You don't have to.
And if you'd rather have the whole thing handled, with the foundation done right and an AI agent working on your revenue every day, that's exactly why I built WebCore. See how WebCore works, or read why your website is a sitting duck when nobody looks after it.
Frequently Asked Questions
What is website security?
Website security is the set of protections that keep a site online, keep visitors' information private, and stop strangers from changing or taking it. For a business, it comes down to encryption on every connection, protection at the edge, a locked domain, accounts only you control, and a way to recover when something breaks.
Is Cloudflare free?
Yes, Cloudflare's free plan includes DNS, free SSL certificates, unmetered DDoS protection, a managed WAF ruleset with 5 custom rules, bot challenges, Turnstile, Web Analytics, Email Routing and AI Crawl Control. Domains bought through Cloudflare Registrar, including .ca, are sold at cost with no markup.
Do I need Cloudflare if my website is on Vercel?
Use Cloudflare for your domain and DNS, but set the records that point to Vercel to DNS only. Vercel already includes DDoS mitigation and a web application firewall on all plans, and its own guide recommends connecting directly instead of putting a second proxy in front.
Is HTTPS enough to make my website secure?
Not on its own. HTTPS encrypts the connection between a browser and the first server it reaches. It doesn't lock your domain, protect your accounts, patch vulnerable code or back up your site, and a proxy in Flexible mode can show a padlock while the trip to your server stays unencrypted.
How much should a small business pay for website security?
Most of the foundation costs nothing: SSL, DDoS protection, a basic firewall and DNS are free from Cloudflare and good hosts. Pay for commercial hosting, for the expertise to configure it, and for work that grows revenue. Be wary of monthly fees for things the free tiers already include.
Sources
- Cloudflare: network, DDoS protection, WAF managed rules, custom rules, SSL/TLS encryption modes, AI Crawl Control, Registrar, supported domains, Content Independence Day, July 1, 2025, November 18, 2025 outage
- W3Techs: Usage statistics of Cloudflare, October 2026
- Vercel: Firewall, Cloudflare with Vercel, Fair use guidelines, Workflows
- Verizon: 2026 Data Breach Investigations Report
- Microsoft: MFA and account attacks, August 2019
- Google: Quality Score, HTTPS as a ranking signal, 2014, A secure web is here to stay, 2018, Largest Contentful Paint, Why speed matters
- Standards: RFC 8446, TLS 1.3, RFC 6797, HSTS, NIST SP 800-38D, AES-GCM
- WebCore: Ontario Trades Web Index, October 2026