Nobody attacks a small business site by hand: a bot crawling the internet for unpatched plugins finds it. The four measures that cover 90% of the risk, and the protocol for when it has already happened.
The objection we always hear is the same: "who would want to hack my site, I run a hardware store?". The answer is that nobody is going to attack you by hand. A bot crawling the internet looking for sites with an unpatched plugin will find you, and that bot neither knows nor cares what you do.
Most compromised small business sites are not robbed of data: they are used to send spam, to host fake bank pages or to inject links. The owner finds out weeks later, when Google flags the site as dangerous and traffic drops to zero.
1. An SSL certificate, the bare minimum
It is the padlock in the browser and it makes the address start with https. It encrypts what travels between the visitor and your server, so a contact form without it travels in plain text.
These days it is free and included with any decent hosting. If your site still shows "Not secure" in the address bar, that is the first thing to fix: beyond the exposure, Chrome warns the visitor and Google uses it as a signal.
2. Updates kept current
By far the number one cause of compromised sites. When a vulnerability is found in a popular plugin, the patch is published and within hours there are bots crawling the internet looking for whoever did not install it.
What to do: check for updates at least once a month, back up before applying them, and uninstall plugins and themes you do not use. A deactivated but installed plugin is still a door.
3. Automatic backups
This is what turns a disaster into a bad afternoon. With a recent backup, a hacked site is restored in an hour; without one, it is rebuilt from scratch.
- They must be automatic. Manual ones get done for two weeks and then never again.
- They must be stored off the same server. If the server goes down or is compromised, backups living on it go with it.
- They must include files and database: with only one of the two the site does not come back.
- Test a restore at least once. A backup never tested is a backup that may not work.
4. Passwords and access
The other major vector is simply guessing the password. A user called "admin" with a short password falls within minutes to an automated attack.
- No "admin" username: rename it.
- Long, distinct passwords for each service, kept in a password manager.
- Two-step verification wherever it is available.
- One user per person, with the minimum permission they need. When someone leaves the team, their access is revoked that day.
What to do if it already happened
In order, without improvising:
- Put the site into maintenance mode so nobody else is exposed.
- Change every password: hosting, admin panel, database, FTP and the associated email accounts.
- Restore the most recent clean backup, from before the incident.
- Update everything before republishing, or you will be reopening the same door.
- Request a review in Google Search Console if the site was flagged as dangerous.
- Check the user list: attackers usually leave themselves an administrator account.
And find out how they got in. Restoring without closing the door means it happens again in two weeks.
How much of this is your responsibility
It depends who you work with, and it is worth having in writing before you sign. Ask who applies the updates, how often backups run, where they are stored and what happens if the site goes down on a Sunday.
A site without maintenance is not cheaper: it is cheaper until the day it stops being cheaper.
Want us to review your site or build a new one?
