Website security is the one item a client never sees while it is working. The site opens, the form sends, everything looks fine. The work that makes this possible happens in the background and ends up on the invoice as the line that is easiest to cross out.
Then one morning the site shows someone else’s content. Or Google puts a warning in front of it. Or visitors start reporting redirects to unknown addresses.
Why attacks hit small websites too
The common belief is that attackers go after big targets. In practice, it is the other way round.
Most attacks are automated. Bots constantly scan the internet for known vulnerabilities in outdated versions of systems and plugins. They don’t care what you do or how many visitors you have. They care about a server they can exploit.
A local tradesperson’s website is just as useful for sending spam as a large company’s. Often more useful, because it is less well protected.
What puts website security at risk
There are only a few entry points, and all of them are predictable.
Outdated plugins are by far the most common cause. A vulnerability is made public, a patch is released, and websites that aren’t updated stay exposed for months. These are exactly the gaps attackers look for first.
Next come weak passwords and the username admin, which bots can guess within hours. Then pirated themes and plugins downloaded from unofficial sources, which often have malicious code built in. And finally an outdated PHP version and shared hosting without account isolation, where a compromised neighbouring site drags yours down with it.
What really happens after a hack
What people expect rarely happens. As a rule, the site doesn’t disappear, because that is of no use to the attacker.
Instead, code is injected that works quietly. The server starts sending spam, the domain ends up on blacklists and your business emails stop reaching clients. Hidden links to foreign destinations are planted on the site, Google recognises them as spam and your rankings drop. Mobile visitors are redirected to someone else’s ads, while on your computer you see a perfectly normal website.
The worst case is when Google flags the site as dangerous. A red warning appears in front of it, traffic drops to zero, and removing the flag takes days even after the problem has been fixed.
How website security is maintained
Protection isn’t a single fix but a set of measures that work together.
Regular updates. The core system, themes and plugins must be kept current, with a check that each update hasn’t broken the layout.
Backups. Automatic, stored away from the server the site runs on, with a tested restore procedure. A backup nobody has ever tested isn’t a backup.
Login protection. A limited number of attempts, a changed login address, two-factor authentication and removal of user accounts that are no longer in use.
Firewall and monitoring. Filtering suspicious traffic before it reaches the site, with regular file scans and alerts when something changes.
SSL certificate and security headers. An encrypted connection is the bare minimum today, but on its own it doesn’t stop intrusions.
Correct file permissions. Settings that prevent code from running where it doesn’t belong, such as the uploads folder.
Why it gets skipped in practice
The reason is simple: as long as it works, nothing shows.
A website built four years ago looks exactly as it did on day one, so people assume it is the same on the inside. In the meantime, a hundred or so updates have come out, several plugins have been abandoned and the password is still the same.
On top of that, maintenance is often billed separately and is the first thing cut from the budget. The cost of cleaning up a hacked site, lost rankings and repairing your reputation regularly exceeds the years of maintenance that were skipped.
How to check the state of your website
A few checks are open to anyone.
Log in to the system and see whether there is a notice about available updates. Check when the latest version of each plugin was released – if it is more than a year old, it has probably been abandoned. In Search Console, open the security issues report. Open the site on a mobile device in a private window and check whether it redirects anywhere.
If any of this looks questionable, don’t put it off. Cleaning up the damage is always more expensive than preventing it.
Our approach
Technical maintenance is included for the first year with most of our website packages. It covers updates, backups, uptime monitoring and fixing technical issues. After the first year, you choose the level you want or end the arrangement with no obligation.
