Website security for a small business: how sites get hit and what is worth doing
Nobody is targeting your bakery because they hate sourdough. They are scanning the internet for known holes: an old WordPress plugin, admin / Welcome1, a form that trusts whatever you type into it.
You may not notice for a while. The site still loads. Meanwhile it is sending spam, or Google has quietly flagged it, or a customer list sat in a plugin folder that should not have been public.
How this usually happens
Old software. A plugin or theme gets a fix. You do not install the fix. Automated scanners find the old version. This is the common path, especially on WordPress.
Guessable logins. Default usernames. Passwords reused from the hosting email. A freelancer who left admin/admin "for convenience." No two-factor anything.
Forms and search boxes that run code. If a contact field can talk to the database without being cleaned, someone will try. This is less common on a well-built modern form, and very common on a ten-year-old PHP template.
A vendor gets burned. You update a plugin and the update was bad. You cannot prevent every supply-chain story. You can keep backups that are not on the same server.
We are not going to paste a chart of "68% of breaches" with a year attached. The pattern is enough: unpatched software and weak logins.
What is worth doing
Update the CMS and plugins on a schedule, not when you remember in December. If that sentence makes you tired, that is what a monthly website plan is for.
Change the admin username off admin. Use a password manager. Turn on two-factor for the host, the CMS, and the email that can reset both.
Put a firewall in front if you can. Cloudflare's free tier stops a lot of noisy scans. It is not magic. It is a filter.
Back up daily, off the web server, and restore one on purpose once in a while so you know the zip file is not empty.
Give admin to fewer people. Limit login attempts. Use HTTPS on the admin pages. Turn off XML-RPC on WordPress if you do not need it.
Treat "urgent security update, click here" emails like they are fake until you log in through a bookmark, not the link.
Signs you should stop and look
Google's "this site may be hacked" interstitial. Redirects to a pharmacy. New admin users you did not add. Customers saying they got mail from your domain that you did not send. A sudden pile of "pages" in Search Console you never wrote.
If any of that is true: change passwords from a different device, turn on 2FA, scan (Sucuri and similar exist for a reason), call the host, and do not keep publishing content on a dirty install.
If you are already hit
Hour one is lock the doors, not redesign the logo. Passwords, 2FA, host ticket, a scan. If you have a clean backup from before the mess, restoring it is faster than picking malware out of a theme file at midnight.
Then figure out how they got in, or the same hole will be waiting next week.
Prevention vs a monthly plan
Web Care is the entry monthly plan: hosting, SSL, backups, monitoring, security, and software updates. That will not make you unhackable. It means updates and backups are not an annual New Year's resolution. See current plan inclusions if you want the full comparison.
If the site is already compromised, we quote a cleanup or a rebuild separately. A monthly plan on a dirty site is how you pay to monitor a fire.
Request a quote if you want us to look. Send the URL and whether you have already seen a warning.