When I tell small business owners their website could be a target, I usually get the same response. "Why would anyone hack us? We're not a bank."
That instinct makes sense, and it's also wrong. Nobody is sitting in a dark room thinking about your landscaping company. What actually happens is automated software scans huge numbers of websites around the clock, looking for known weak spots. It doesn't care who you are. If the door is unlocked, it walks in.
What do they want with a small site?
A hijacked small business site is useful in a few ways.
- Spam and scam pages. Hidden pages selling pills, fake designer goods or dodgy links, hosted on your good reputation.
- Redirects. Your visitors get quietly bounced to a malicious or shady site.
- Malware distribution. Your site serves harmful downloads to your own customers.
- Stolen form submissions. Names, emails and phone numbers sent to someone else.
- Using your server for attacks. Your hosting gets turned into a tool against others.
The business owner often finds out when Google flags the site as dangerous, or a customer calls to say their antivirus screamed at them.
How it usually happens
Out of date software and plugins
This is the big one. Content management systems like WordPress are powerful, but they rely on plugins and themes written by lots of different people. When a weakness is found in one, it gets published, and attackers rush to scan for sites still running the old version. A plugin you installed three years ago and forgot about can be the way in.
Weak or reused passwords
If your admin password is something like your business name plus a year, or the same one you use on five other sites, you're one leaked database away from trouble. Attackers try lists of stolen passwords against login pages automatically.
Too many people with too much access
The old developer who still has an admin account. The cousin who "helped out" once. Every extra login is another way in, and the ones nobody uses are the ones nobody watches.
No backups
This one doesn't cause a hack, but it decides how bad it gets. With a clean recent backup, a compromised site is an annoying afternoon. Without one, it can mean rebuilding from scratch.
Cheap, neglected hosting
Bargain shared hosting where nobody updates the server, or where thousands of sites share the same space, can leave you exposed to problems you didn't create.
What actually keeps you safe
- Keep everything updated. Software, themes and plugins. Delete anything you don't use.
- Use strong, unique passwords and a password manager. Turn on two factor login wherever it's offered.
- Limit who has access, and remove people when they're done.
- Use HTTPS everywhere. We covered that in another post.
- Keep automatic backups stored somewhere other than the website itself.
- Use a web application firewall or a service in front of your site that filters out obvious bad traffic.
- Keep it simple. The less code and fewer moving parts you run, the less there is to attack.
The simplest fix is a simpler site
This is a big part of why we build the way we do. Our sites are lightweight pages served through Cloudflare, without a database or a pile of plugins sitting behind them. A lot of the classic attacks need exactly those things. If they aren't there, there's nothing to exploit.
That doesn't mean any site is magically unhackable, and I'd be lying if I said so. It means the attack surface is far smaller, and the day to day maintenance burden mostly disappears. My background is in commercial audio visual and network security, so I'm a bit fussy about locking things down before a site goes live.
If you think you've been hacked
- Don't panic, and don't delete things yet.
- Change your passwords, starting with hosting and admin accounts, from a device you trust.
- Contact your host and ask if they can see what happened.
- Restore from a clean backup if you have one.
- Find and close the hole, or you'll be back here in a month.
If you'd like someone to look over your current site, just reach out. A quick review costs you nothing, and finding out early is a lot cheaper than finding out from a customer.