Website Security for Service Businesses: What Contractors, Clinics, Law Firms and Stores Need

Every service business website needs the same core protections: supported software kept up to date, two-factor sign-in for every admin, tested backups and a short list of trusted plugins and scripts. On top of that, some businesses carry specific rules. Stores that take cards fall under PCI DSS v4.0.1, including the payment-page script requirements that became mandatory on 31 March 2025. Clinics that handle electronic health information must follow the HIPAA Security Rule now in force. Firms that are "financial institutions" under federal law, such as tax preparers and mortgage brokers, must follow the FTC Safeguards Rule.

One common point of confusion: as of October 2026, the proposed update to the HIPAA Security Rule is still only a proposal. The existing rule applies today. The update does not.

This guide covers what each rule means for a website, which parts apply to contractors, clinics, law firms and online stores, and a practical baseline for everyone else. It is general information, not legal advice. For decisions about your own obligations, talk to your attorney or compliance advisor.

What Every Service Business Website Has in Common

Contractors, clinics, law firms and stores look different, but their websites share the same weak points:

• Forms that collect names, phone numbers, addresses and sometimes far more sensitive details.
• Logins for the CMS, the host, the domain registrar and any portal, often shared among staff and former vendors.
• Plugins and third-party scripts for booking, chat, reviews, analytics and payments.
• The server software underneath, such as PHP. The PHP2Shell flaws fixed in October 2026 were in PHP itself, so they affected sites regardless of the CMS on top. See what PHP2Shell is.
• Vendors: the host, the web developer, the form or booking provider. Each one can expose your data.

Plugins deserve extra attention. Patchstack's report on 2025 data found that 91% of new vulnerabilities in the WordPress ecosystem were in plugins and 9% in themes. Logins matter just as much. That is why the baseline later in this guide matters as much as any single regulation.

Online Stores: PCI DSS v4.0.1 and Payment-Page Scripts

PCI DSS v4.0.1 is the current version of the card industry's security standard. It was published in June 2024 as a limited revision with "no additional or deleted requirements." Two requirements affect almost every store website:

• 6.4.3 requires control over scripts on payment pages.
• 11.6.1 requires a way to detect unauthorized changes to payment pages.

PCI SSC says these "focus on ensuring that payment page scripts are properly authorized, checked for integrity, and monitored for tampering" (PCI SSC e-skimming supplement, March 2025). They became effective on 31 March 2025.

The SAQ A note

Many small stores send card entry to a payment provider's hosted page or embedded frame and validate with Self-Assessment Questionnaire A (SAQ A). In January 2025, PCI SSC removed 6.4.3 and 11.6.1 from SAQ A. In their place, SAQ A merchants must "confirm their site is not susceptible to attacks from scripts that could affect the merchant's e-commerce system(s)." PCI SSC added that this does "not remove or diminish the underlying" requirements.

In practice, SAQ A is not a reason to ignore your own scripts. If someone can change the page that sends customers to checkout, they can send them somewhere else. Our PCI DSS 4.0 website guide explains what to inventory and monitor. PCI SSC also says the Council "does not enforce compliance or determine whether specific implementations are compliant," so ask your payment processor or acquiring bank what validation they expect.

Clinics and Health Practices: The HIPAA Security Rule

The HIPAA Security Rule in force today is at 45 CFR Part 164, Subpart C. It says "A covered entity or business associate must comply" with its standards "with respect to electronic protected health information." Its technical safeguards section (164.312) lists five standards:

Some implementation specifications are "Required" and others "Addressable." Encryption in transit, for example, is listed as addressable. Addressable does not mean optional. Under 164.306(d)(3), you must assess each one and either implement it or document why it is not reasonable and appropriate and implement an equivalent measure where that is reasonable. How that applies to you is a question for your compliance advisor.

The proposed update is not final

HHS published a notice of proposed rulemaking on 6 January 2025 to modify the Security Rule. Comments closed on 7 March 2025. As of October 2026, no final rule has been published, and the latest Unified Agenda entry moves it to "Long-Term Actions" with a final action date of 07/2027. That date has already slipped once: the Spring 2025 agenda showed May 2026. Be wary of any vendor selling compliance with "the new HIPAA rule." It doesn't exist yet.

For a clinic website, the practical questions are simple. Which forms or portals collect health information? Where does that data go (email, a database, a third-party tool)? And which vendors touch it? A vendor that handles ePHI for you may be a business associate, which usually means a written agreement. Ask your compliance advisor.

Finance-Adjacent Businesses: The FTC Safeguards Rule

The FTC Safeguards Rule (16 CFR Part 314) applies to "financial institutions" under the FTC's jurisdiction. The term is much wider than banks. The rule's own list includes "mortgage lenders, "pay day" lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, ... collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions" and some investment advisors. Its examples also include a retailer that issues its own credit card to consumers and an auto dealership that leases cars for more than 90 days.

If you are covered, the rule requires, among other things:

• A risk assessment and a designated "Qualified Individual" who runs the program, who may work for a service provider.
• Multi-factor authentication "for any individual accessing any information system," unless the Qualified Individual approves an equivalent control in writing.
• Encryption of customer information "both in transit over external networks and at rest," or approved compensating controls.
• Oversight of service providers, including "Requiring your service providers by contract to implement and maintain such safeguards."
• Continuous monitoring, or annual penetration testing and vulnerability assessments at least every six months.
• A written incident response plan.

Businesses that hold customer information on "fewer than five thousand consumers" are exempt from some parts, including the written risk assessment, the testing schedule, the written incident response plan and the annual report to the board.

Since 13 May 2024, a "notification event" involving "at least 500 consumers" must be reported to the FTC "as soon as possible, and no later than 30 days after discovery." A notification event means acquisition of unencrypted customer information without authorization. If a contractor or other business extends credit to customers itself, rather than referring them to a lender, ask counsel whether the rule reaches it.

Law Firms and Professional Practices

No single federal rule sets website security requirements for law firms. The obligations usually come from three places: professional conduct rules on protecting client information (check your state bar), security terms in client contracts, and state data breach laws. In practice, a law firm website is a front door to sensitive matters. Intake forms often collect facts about a case, and email systems hold the rest.

Keep intake forms short, send submissions to a protected system rather than a shared inbox where you can, and treat the website login, the domain registrar and the email account as one security perimeter. Corporate clients may also send you vendor questionnaires; our vendor security review guide shows what those ask.

Contractors and Home Service Companies

Contractors are rarely covered by an industry security rule, but their websites still collect home addresses, phone numbers, photos and sometimes payment details. The main risks are a hijacked site that sends leads to someone else, a payment link that is quietly swapped, and a lost domain or hosting login when a past web vendor leaves.

• Own your domain, hosting account and CMS admin in your company's name.
• Take payments through your processor's hosted page or link, not a form on your site.
• Remove former employees and vendors from every account.
• Keep tested backups you can restore yourself. See backups and recovery.

State Breach Laws: A Pointer, Not a Summary

According to the National Conference of State Legislatures, all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring notice of security breaches. That summary was last updated in January 2022, so use it as a starting point only. Check your state's current statute, and the laws of the states where your customers live, with your attorney. Who to notify, how fast and what counts as personal information all vary by state.

A Practical Baseline for Every Service Business

CIS calls its Implementation Group 1 "the on-ramp to the CIS Controls," a set of 56 safeguards for organizations "with limited IT and cybersecurity expertise." For a website, the core of it looks like this:

Our access control and 2FA guide covers the single most effective step. For the first hours of an incident, an incident response retainer gives you someone to call.

Conclusion

Start with the baseline every business needs, then add the rules that fit your work: PCI DSS for card payments, the current HIPAA Security Rule for health information and the FTC Safeguards Rule if your business is financial in nature. Watch the HIPAA update, but don't plan around a rule that isn't final. If you want to know where your site stands against these rules, a website security assessment is the place to start, and our website security services can handle the fixes. More in our website security consulting guides.

Frequently Asked Questions