We have heard that sentence dozens of times, always before and never after. Understanding why small business websites get hacked takes away a lot of the fear and saves a fair bit of money, because the reason has nothing to do with how interesting your business is: it has to do with how unattended your site is.
They did not pick you
Behind almost no attack on a small website is a person looking at your business. There are programs crawling the internet automatically, hunting for out-of-date versions of content managers, themes and plugins with holes that are already known and published.
When they find one, they walk in. It makes no difference whether the site belongs to an accountancy firm, a garage or a bike shop: what they were after was not your company, it was that version of the plugin you have not updated in two years.
What they are actually after
Hardly ever your information. The usual motives are duller and more profitable for whoever is doing it:
- Sending junk mail from your server, until your domain lands on blocklists and your legitimate email stops arriving.
- Slipping hidden pages inside your site —usually from industries you would rather not be associated with— to borrow the standing your domain has on Google.
- Redirecting your visitors elsewhere when they arrive on a phone, which is what makes it take weeks to notice.
- Using your hosting to store files or attack others.
The real damage is not movie-dramatic: it is that your email stops working, Google flags your site as unsafe, and you lose rankings that took two years to build.
The four doors they come through
Almost every case that reaches us fits one of these four, and all four can be closed without spending much.
1. Plugins and themes left unupdated
By far the most common route. Every plugin you install is one more door somebody has to keep shut, and plenty of them were written years ago by someone who no longer touches them. The problem is not having plugins: it is having fifteen and not knowing what twelve of them are for.
2. Reused passwords
The same password you use on an online shop that leaked three years ago. Those lists circulate and get tried automatically across thousands of sites. If yours is on one, no technical hole is needed: they walk through the door with the key.
3. The login panel itself
If your site has a well-known login address, it takes automated attempts every day, whether you know it or not. Most fail, but only one needs to land, and an old forgotten user with a weak password is enough.
4. Poorly separated shared hosting
When dozens of sites share a server without proper isolation, a compromised neighbour can end up splashing onto the rest. This is the part that does not depend on you, which is why it is worth knowing where your site is hosted and who answers if something happens.
How to tell it has already happened
Plenty of sites sit compromised for months without anybody noticing. These are the signs, from the most obvious to the most subtle:
- Google warns in the results that the site may be dangerous.
- Your emails start bouncing or landing in everybody's junk folder.
- The site suddenly gets much slower for no reason.
- Admin users appear that you did not create.
- Searching Google for site:yourdomain.com turns up pages you do not recognise.
That last check is free and takes ten seconds. Type site: followed by your domain, no space, and see whether everything listed is yours.
The first 24 hours
If you confirm it has happened, the order matters more than the hurry:
- Tell whoever looks after your site and your host. Serious providers have a procedure for this.
- Change every password from a different computer: hosting, content manager, database, email and domain registrar.
- Restore a backup from before the problem, not yesterday's. If the only copy you have is from the day before and it was already infected, it is no use.
- Update everything before publishing again, or you will be back where you started within a week.
- Review the user list and delete anybody you do not recognise.
- Request a review from Google if you were flagged, so the warning gets removed.
If you are stuck on where to start, Spain's INCIBE cybersecurity helpline assists companies and individuals free of charge, and has material specifically for small businesses in its business section.
The part almost nobody knows: if customer data was involved
When the site holds personal data —a contact form with names and phone numbers already counts— and it is compromised, there are obligations to meet. The Spanish Data Protection Agency explains how a security breach is handled and when it has to be reported, working to a reference window of 72 hours from becoming aware of it.
This is not to frighten anybody: it is so whoever looks after your site knows, and you do not discover the paperwork three weeks late. Worth asking before you need it.
Want to know what it would cost you?
We reply the same day. No commitment, no sales pitch.
How to cut the risk without losing your mind
Perfect security does not exist, but almost every attack on a small site is prevented by unglamorous things:
- Fewer plugins. Every one you remove is one less door to watch. If you have not used it in six months, out it goes.
- Updates kept current, with a backup taken right before in case something breaks.
- Unique passwords and two-step verification on the panel and the email.
- Automatic backups somebody checks. A backup nobody has ever restored is not a backup, it is a folder.
- Access in your own name, so you can act without depending on anybody. We cover it in who owns your domain.
All of that is exactly what a paid website maintenance should cover. If yours does not include it, it is not maintenance: it is hosting under another name.
What does not work
Installing a security plugin and forgetting about it. It is the most-sold solution and the one that works least on its own: a good lock on a door nobody checks is still a door nobody checks. It helps, but it does not replace keeping the site current.
Nor does hiding the login address and leaving it at that. It gets found in minutes and creates a false sense of calm.
The option almost nobody raises: remove the door
If your site is informational —what you do, where you are, how to get in touch, your services and your articles— it does not need a content manager with a database and a login panel running twenty-four hours a day. It can be built in HTML and CSS, and then there are no plugins to update, no database to attack, and no login screen taking attempts every night.
It is not magic and it does not make you invulnerable: hosting, domain and email still need looking after. What changes is the surface: you go from watching twenty pieces to watching three. And it usually runs considerably faster, which is the other classic problem with plugin-heavy sites, covered in why your website is slow on mobile.
If the switch worries you because of rankings, that is a reasonable fear with a solution: the addresses stay and whatever needs redirecting gets redirected, as we explain in migrating a website without losing rankings.
What it costs to have this covered
In our published plans, hosting, domain, email and maintenance are included: 100 € a month for the one-page landing and 200 € for the site with up to ten subpages, with one monthly article. The 400, 750 and 1,500 € plans add articles, Google profile, reviews, campaigns and social media. Excluding VAT, no lock-in, migration included.
And if what you have today is a content manager stuffed with plugins nobody has touched in years, message us on WhatsApp with your website address. We will take a look, tell you whether anything looks off and what we would do first. No strings, same day.
Tell us what you need and we'll give you a price
We reply the same day. No commitment, no sales pitch.