Cybersecurity
Why Small Business Websites Get Hacked (and How to Stop It)
On self-hosted WordPress sites, an unpatched plugin is a common way in, found by automated scanners that don't care who you are. This guide covers how attackers find these openings, what a hacked site gets used for, and the concrete habits that prevent it.
Your website is one of those things you set up once and then stop thinking about. It sits there doing its job, so there's no reason to touch it. That's exactly why a neglected website is one of the common ways a small business gets hacked.
WordPress powers more than 40% of all websites, according to W3Techs, and it's the platform behind a large share of small-business sites too. WordPress's core software is generally solid. As the next section covers, the bigger risk tends to be the plugins and themes added to it, which often don't get updated for years.
How a Neglected Website Gets Hacked
Attackers don't usually pick your business by name. They run automated tools that scan huge numbers of websites looking for known weak spots, like a plugin with a security hole that hasn't been fixed. When the tool finds one, it breaks in. It's all automatic, and it isn't aimed at you personally.
That's why old plugins are the problem. When a plugin maker finds a security flaw, they release an update to fix it. Until you install that update, the hole stays open, and the automated scanners know exactly what to look for. Security researchers who track WordPress flaws find that the large majority are in plugins and themes, not in WordPress itself.
What a Hacked Website Is Used For
A hacked website rarely announces itself. Instead of shutting your site down, attackers usually keep it running and use it for their own purposes:
- Serving malware. Your site gets changed so that visitors are infected or pushed to a page that tries to install something.
- Spam and scam pages. Attackers add hidden pages selling fake goods or pushing scams, riding on your site's good standing with search engines.
- Stealing form data. If your site has a contact or checkout form, a hacked site can copy what people type into it, including personal or payment details.
- Redirects. Visitors who click your link get sent somewhere else, often a scam or malware site.
The damage lands on you even though the attacker was after your visitors. Search engines flag hacked sites with warnings and drop them down the rankings, and browsers may block them, so customers see a red "this site may be dangerous" screen instead of your homepage.
Is Your Website at Risk
It depends on how your site is built.
If you use a hosted website builder like Wix, Squarespace, or Shopify, most of the security and updates are handled for you behind the scenes, so your risk is lower.
If you have a self-hosted WordPress site, usually set up by a web designer or agency on your own hosting, then keeping WordPress, the plugins, and the themes updated is someone's job. The question is whose. On a lot of small-business sites, the honest answer is that nobody has touched it since it launched.
You can usually tell your site is at risk if you don't know who maintains it, it hasn't been updated in a year or more, or it's running plugins from a developer who has since disappeared.
How to Keep Your Website Safe
A few consistent habits prevent most of this:
- Keep everything updated. WordPress, plugins, and themes all need updating when new versions come out. Many sites can be set to update automatically.
- Remove plugins you don't use. Every extra plugin is another thing that can go wrong. If you're not using it, delete it.
- Stick to well-known plugins. Use ones that are popular, well-reviewed, and updated recently. Avoid anything that hasn't been touched in years.
- Watch for abandoned plugins. Sometimes a plugin stops being updated, or gets removed from the plugin store because of a security problem. When that happens it stops getting fixes, so check now and then that the plugins on your site are still supported, and replace any that aren't.
- Lock down the admin login. Use a strong, unique password for the website's admin account, and turn on multi-factor authentication if your setup supports it.
- Add a security plugin or web firewall. A reputable one can block common attacks and warn you when something changes. Your web host or IT provider can recommend one.
- Keep backups, stored separately, and test them. A recent backup lets you restore the site instead of rebuilding it from scratch, but only if it actually works and wasn't touched by whoever got in. Store copies somewhere separate from the hosting account itself, and have your host or IT provider periodically confirm a backup restores cleanly before you need it for real.
- Know who's responsible. Decide who looks after updates and security, whether that's your web designer, your IT provider, or your hosting company, and make sure it's clearly somebody's job.
What to Do if Your Site Is Hacked
If your site does get hacked, moving quickly limits the damage:
- Get help right away. Cleaning a hacked site properly is a job for your web host, IT provider, or a website security service. Most hosts have dealt with this many times and can help.
- Take the site fully offline. A simple "down for maintenance" page alone may not be enough, since an attacker with access to the site's files can still reach pages underneath it. Ask your host or IT provider to block public traffic to the site, or take it offline at the server level, while it's being cleaned up.
- Call your insurer as soon as the hack is confirmed. Do this before remediation gets underway, not after, even if you don't yet know whether any data was exposed. Many cyber insurance policies cover more than data breaches and require the insurer's consent, or use of their approved responders, before you start spending on cleanup. If the site handled customer details or payments, loop in a lawyer too, since they can flag any regulator notice deadlines.
- Preserve the evidence before you clean anything up. Have your host or IT provider save a copy of the site as it was, including any unfamiliar files and access logs, before restoring a backup or deleting anything. That evidence is what an investigator needs to work out what was accessed.
- Change your hosting account password right away, and revoke other live access too. From a device you know is clean, change the password for your hosting account and turn on multi-factor authentication. Also have your host or IT provider revoke any FTP/SFTP or API credentials, other admin accounts you don't recognize, and active login sessions, right now rather than waiting, since anything left standing can be used again while the site is being cleaned up.
- Restore a clean backup. If you have a backup from before the hack, restoring it is often the fastest fix. If you don't, the site will need to be cleaned by hand.
- Reset the website admin and database passwords again after restoring. A backup can bring those specific passwords back with it, so change them (and turn on multi-factor authentication) once the restore is done, not before, or the access the attacker had comes right back.
- Update and tidy up before it goes back live. Update WordPress, the plugins, and the themes, and remove anything you don't recognize or no longer use, so the same hole doesn't get used again.
- Tell anyone whose data was affected. Check whether customer or staff data was exposed, and let those people know if it was.
Frequently Asked Questions
How do I know if my website has been hacked?
Common signs are a warning from Google or your browser, a drop in search traffic, pages or pop-ups you didn't add, or your web host getting in touch about a problem. If you're not sure, your IT provider or web host can check.
Do I need to update my website if it works fine?
Yes. A site can look completely normal to you while an out-of-date plugin leaves a door open for attackers. Updates close those holes, which is why they matter even when nothing looks wrong.
I use Wix or Squarespace. Am I at risk?
Much less so. Hosted builders handle the updates and most of the security for you. You should still use a strong admin password and MFA, but you're not responsible for patching plugins the way a self-hosted WordPress site is.
Who should maintain my website?
Someone should own it clearly: your web designer or agency, your IT provider, or your hosting company, depending on your setup. The important thing is that someone is actually doing the updates.
What is a security plugin or web firewall?
It's a tool that sits on your website, blocks common attacks, watches for changes, and can alert you to problems. On WordPress, a reputable security plugin is a common, low-cost way to add that protection.
If your website hasn't been updated in a while, or nobody is sure whose job it is, contact Cyber One Solutions. We handle ongoing website updates and security alongside broader managed cybersecurity for businesses across Texas and Tennessee.