Process
What Actually Keeps a Small Business Website From Getting Hacked
By the LA Web Design team5 min read
Most small business owners assume nobody would bother hacking their website. They're right that nobody is targeting them personally. Nearly all attacks on small websites are automated: bots scanning millions of addresses for a known hole in an outdated plugin, a login page that allows unlimited password guesses, or an admin account still named “admin.” Your website gets found because it's vulnerable, not because it's yours.
Updates are most of the job
On WordPress, the large majority of reported security holes are in plugins, not in WordPress itself. When a fix is released, details of the hole usually become public along with it, and bots start scanning for websites that haven't updated within days. Keeping WordPress, the theme, and every plugin current closes most of the doors attackers actually use. Delete plugins you've deactivated, too; the code is still sitting on the server.
Logins are the second door
Turn on two-factor authentication for every admin account. Give each person who needs access their own login with only the permissions they need, and remove accounts the day someone leaves or a vendor relationship ends. Limit login attempts so a bot can't guess passwords all night. None of this costs anything, and together it stops the bulk of break-in attempts.
Backups you've actually tested
A backup only counts if you can restore it. Keep daily backups stored somewhere other than the server the website runs on, keep several weeks of them, and restore one to a test copy at least once so you know the process works. If the worst happens, the difference between a working backup and none is an afternoon of cleanup versus starting over.
Hosting is part of security
Bargain shared hosting puts your website on a server with hundreds of others, and a problem on one can spill over to its neighbors. Good managed hosting adds a firewall, malware scanning, server updates you don't have to think about, and support that answers when something goes wrong. It's one of the few places where the cheapest option tends to cost more in the end.
How you'd find out
Hacked websites often look normal to their owners. The signs to watch for: Google showing “This site may be hacked” under your listing, a security email from Search Console, strange pages in a site:yourdomain.com search, or customers mentioning that your website sent them somewhere odd. Setting up Google Search Console means you hear about it by email instead of from a customer.
Security is the main reason maintenance after launch isn't optional. A website that was secure on launch day isn't still secure after two years of skipped updates.