Website security conversations usually begin in the wrong place, with sophisticated targeted attacks that almost no small business will ever face. That framing produces either paralysis or expensive defence against the wrong threat.
The reality is mundane. Automated scanners sweep the entire internet continuously, looking for known vulnerabilities in common software, weak credentials and misconfigurations. Your site is found because it matched a pattern, not because anyone chose it.
That changes what defence looks like. You are not outwitting an adversary; you are staying off a list of easy matches, and most of what achieves that is unglamorous maintenance.
Who should be responsible for this
Security fails in small businesses less from ignorance than from ownership. Everyone assumes someone else is handling updates, and nobody is.
Name one person accountable, internally or at your supplier, and write down what they are responsible for: applying updates on a schedule, verifying backups by restoring them, reviewing who has access, and responding if something happens. Ambiguity here is what produces sites running eighteen months behind on patches.
If it sits with an external supplier, it should be in the contract rather than assumed as part of a vague retainer. Ask specifically what was updated last month and whether it was tested before going live. A supplier doing the work can answer immediately.
Review access quarterly and remove what is stale. Former employees, a designer who finished a project two years ago, an agency you no longer work with. Every dormant administrator account is a credential that can be compromised without anyone noticing it was still there, and dormant accounts are among the most common entry points we find during incident investigation.
In practice
How business sites actually get compromised
Four routes account for the overwhelming majority of compromises we are called in to investigate.
Outdated software with a known vulnerability. A plugin, theme or framework with a published flaw, unpatched, found by a scanner that was specifically looking for that version. This is by far the most common, and it is entirely preventable by updating.
Weak or reused credentials. An administrator password that is guessable or was exposed in an unrelated breach, with no second factor. Credential-stuffing attacks try known username and password pairs at enormous scale and succeed often enough to be worthwhile.
Insecure file upload. A form allowing users to upload files without validating what they are, permitting an executable script to be placed on the server.
And exposed credentials in code, usually a database password or an API key committed to a repository that later became public, or left in a configuration file reachable from the web.
None of these require sophistication. All four are found by automation.
In practice
The measures that matter
Ranked by how much compromise they actually prevent per rupee and per hour spent.
What you can safely deprioritise
Some things are sold as security and deliver little.
Expensive SSL certificates. Encryption from a free certificate is identical to encryption from a costly one. Paid certificates buy warranty and validation display, not stronger protection. Anyone charging substantially for basic SSL is selling you something you can have free.
Security plugins stacked several deep. They conflict, slow the site, and each adds its own attack surface. One well-configured layer is better than four overlapping ones.
Obscurity measures such as hiding your CMS version or renaming the admin path. These stop nothing determined and give a false sense of protection. They are not harmful, they are simply not security.
And penetration testing for a brochure website. It is valuable for an application handling money or sensitive data, and for a marketing site the same money spent on maintenance and backups prevents far more.
If you are already compromised
The first hour matters and the instinct to quietly delete the bad file is usually wrong.
Take the site offline or into maintenance mode. A compromised site serving malware to visitors is damaging your customers and your search presence with every hour it stays up.
Change every credential: hosting, database, CMS administrators, FTP, and any API key present in the code. Assume all of them are known.
Do not simply restore the most recent backup. You do not yet know when the compromise occurred, and the recent backup may contain it. Identify the entry point first, from server logs and file modification times, then restore from a point known to precede it.
Then close the route that was used, because restoring without fixing the vulnerability guarantees a repeat within days. And request a review in Search Console if Google has flagged the site, because the warning persists until they recheck.
If the site handled payment or personal data, you may have notification obligations under applicable data protection law. That is a question for your legal adviser rather than your developer.
Key takeaways
- You are not targeted. Automated scanners find sites matching known vulnerability patterns.
- Outdated software and weak credentials account for most compromises and both are preventable.
- Deactivated is not removed. Unused plugins and themes remain attack surface.
- An untested backup is a hope. Restore one twice a year and keep copies off the server.
- Expensive SSL buys warranty, not stronger encryption. Free certificates encrypt identically.
- After a compromise, find the entry point before restoring, or you will restore the compromise.
Frequently asked
WordPress core is reviewed by a large security team and patched promptly. Compromises overwhelmingly come from outdated plugins with known vulnerabilities and weak credentials. The platform is a target because of its scale, so automated scanners sweep for vulnerable plugin versions at enormous rate. Maintained properly it is perfectly secure for a business; installed and forgotten it will eventually be compromised.
No. Encryption from a free certificate is identical to that from a costly one. Paid certificates buy a warranty and, for extended validation, a display difference that most visitors never notice. Anyone charging substantially for basic SSL is selling something you can obtain free and automatically renewed.
Take it offline or into maintenance mode, because a compromised site serving malware damages your customers and your search presence every hour. Then change every credential, assuming all are known. Do not immediately restore the most recent backup: identify the entry point from logs and file modification times first, because a recent backup may already contain the compromise.
Most of what matters is maintenance rather than products. A well-run update and backup process for a business site costs roughly ₹3,000 to ₹15,000 a month depending on complexity, and a cloud web application firewall adds a small amount. That combination prevents far more than expensive security products bolted onto an unmaintained site.