Web security for small businesses starts with a few habits: turn on two-step verification, update your software, keep backups you can actually restore and give each person only the access they need. That covers a good part of the most common risks that OWASP lists, the reference the industry uses.
Here are the 10 risks of the 2025 edition in plain language and 7 habits to start today.
What is the OWASP Top 10 and why does it matter?
It is the list of the ten most critical security risks in web applications, published by OWASP. The 2025 edition is the first update since 2021 (The Register). It is not a standard you must "comply" with: it is a map of where websites tend to fail.
What are the 10 OWASP 2025 risks?
The official list is at top10.owasp.org. Here is how to read each one:
| # | Risk | In plain words |
|---|---|---|
| A01 | Broken Access Control | Someone can see or do what they should not, like an employee walking into the vault |
| A02 | Security Misconfiguration | Doors left open by default: settings nobody reviewed |
| A03 | Software Supply Chain Failures | The problem comes from a third-party piece you use, like a library |
| A04 | Cryptographic Failures | Data that travels or is stored without proper protection |
| A05 | Injection | Text someone types that the system runs as a command |
| A06 | Insecure Design | Security was not thought through from the start |
| A07 | Authentication Failures | Weak sign-ins or ones that can be bypassed |
| A08 | Software or Data Integrity Failures | Trusting code or data without checking it was not altered |
| A09 | Security Logging and Alerting Failures | Something bad happens and nobody finds out |
| A10 | Mishandling of Exceptional Conditions | Errors the system cannot handle and that open a gap |
The first, broken access control, stays at the top of the list (The Register). Software supply chain failures (A03) is a new category in this edition.
Which 7 habits improve web security for small businesses?
- Two-step verification on email and critical accounts. CISA explains that even if someone steals your password, the second step can block access; and it recommends turning it on for every account or app that offers it (CISA). Start with email, because that is where your other accounts get recovered.
- Automatic updates. Many updates fix security flaws, so postponing them leaves known weaknesses open. CISA recommends turning on automatic ones (CISA). Prioritize the browser and the system.
- 3-2-1 backups. Three copies, on two kinds of storage and one away from your business. CISA adds protecting them with encryption and keeping an offline copy, because ransomware looks for and deletes accessible backups (CISA).
- Test restoring. A copy you have not restored is an assumption. Try recovering one file and a full folder, and confirm you can roll back at least seven days.
- Minimum access. Each person uses only what they need, and access is removed when someone leaves. It is the defense against risk A01.
- Review third parties. Plugins, libraries and vendors are part of your risk surface (A03). Remove what you do not use and update what you do.
- Get told when something fails. An error log and alerts (A09) let you find out before your customers do.
How do we do it at Mokev?
A few examples from our own site, without this being a full audit:
- Access (A01 and A07). Permissions are read from server-side data that the person cannot modify. And our single sign-on between sites uses one-time 256-bit codes that expire after 60 seconds and are stored only as a hash.
- Alerts (A09). We use Sentry to receive production errors. In October 2026 it helped us detect that an iPhone browser version could not open a digital card.
- Third parties (A03). Third-party scripts (analytics, pixels) wait for someone to interact with the page and do not load on their own.
If you want your site or store's security reviewed, see our consulting and web development services, or write to us.
Frequently asked questions
What is OWASP?
It is the organization that publishes the OWASP Top 10, the list of the most critical security risks in web applications. The current edition is 2025.
Where do I start if I do not know about security?
With three things: two-step verification on your email, automatic updates and tested backups. They are low cost and CISA recommends them.
What is two-step verification?
It means asking for a second piece of information besides the password, such as a code from your phone or an authenticator app. According to CISA, if someone steals your password, they will not be able to complete the second step.
How often should I make backups?
CISA recommends a solution that runs automatically and regularly, and testing restores. The right frequency depends on how much work you can afford to lose.
Is having HTTPS the same as being secure?
No. HTTPS protects what travels between your site and the visitor ([web.dev](https://web.dev/articles/why-https-matters)), but it does not cover the other risks on the list, such as badly configured access.
