Q:

If Yahoo can get hacked , how can we secure our small websites? 

Law enforcement provided Yahoo in November 2016 with data files that a
  third party claimed was Yahoo user data.  We analyzed this data with
  the assistance of outside forensic experts and found that it appears
  to be Yahoo user data.  Based on further analysis of this data by the
  forensic experts, we believe an unauthorized third party, in August
  2013, stole data associated with more than one billion user accounts. 
  Yahoo has not been able to identify the intrusion associated with this
  theft.  We believe this incident is likely distinct from the incident
  we disclosed on September 22, 2016.  We are notifying potentially
  affected users and have taken steps to secure their accounts,
  including requiring users to change their passwords.  Yahoo has also
  invalidated unencrypted security questions and answers so that they
  cannot be used to access an account. 

Yahoo says more than one billion accounts got hacked.  That's obviously terabytes of data. 
My question is, how can we secure website user information from hackers?  Yahoo uses top level security, yet hackers managed to hack them.  They are obviously using hashes and several encryption methods, but how did hackers breach their systems?  
Are we all at risk?  
Are the current security solutions not enough to prevent an attack?  
Need answers from penetration testers and security professionals. 

A:

Being big does not equal being better secured
Don't assume that becuase they are big and famous, everything they do is better than what you can do. 
Nothing has changed - you can secure your small websites the same way you did before, perhaps better since you can learn from Yahoo's mistakes.  Continually updating your password hashing, instead of using md5, would be a good start. 
Sometimes, being big also means it takes a long time to update security measures, it wouldn't surprise me if "update password hashes" has been in somebodies to-do list for many years. 

A:

Use a separate computer to manage the site
Most data breaches do not involve the website being hacked.  Instead, an internal workstation is hacked when the user visits a malicious web page; this is called "drive by malware".  With one internal system compromised, "lateral escalation" is performed, until the attackers take control of a computer with access to the database.  They can then extract and exfiltrate the data. 
The reason this roundabout route is used is that many web sites are extremely difficult to hack directly.  If the organisation takes reasonable precautions, there will be no known vulnerabilities, and it would require a "zero day vulnerability" to hack directly.  In contrast, office IT environments are usually poorly secured, so this is the easier route for hackers to target. 
The solution to this is to have entirely separate "privileged access workstations" that are "air gapped" from the Internet.  This has been standard practice in classified military/intelligence networks for years, but is rare in commercial systems.  The breach indicates that Yahoo are not doing that.  While you could criticise them for that, they are only the same as many industry peers.  However, as a small website, you can do things differently.  Make sure your website is secured, and use a separate laptop for managing your site.  Don't do any browsing from that laptop. 
I've kept this answer high-level so it doesn't get too long.  For further reading, look up some of the phrases I've included in quotes.