Security · 5 November 2026 · 5 min read
Website hacked? How small businesses protect their site
Attacks are rarely targeted; they automatically find every vulnerable site. The most common ways in, and seven measures that actually protect you.
Many businesses think: why would anyone hack my website? The answer: nobody personally. Attacks run automatically and scan around the clock for sites with known weaknesses. Size or industry doesn't matter.
The most common ways in
- Outdated software, themes and plugins with known holes.
- Weak or reused passwords for the admin area.
- Too many people with full admin rights.
- Forms without spam and abuse protection.
- Cheap hosting without updates or monitoring.
What can happen
- Your site spreads malware, and Google warns visitors or drops you from search.
- Spam is sent through your form or server.
- Customer data is stolen, with possible GDPR reporting duties.
- The site is defaced or goes offline entirely.
Seven measures that actually protect you
- 01
Apply updates promptly
Most attacks use holes that were patched long ago.
- 02
Strong passwords and 2FA
A password manager and two-factor login for every admin account.
- 03
Grant rights sparingly
Everyone gets only what they need. Delete old accounts.
- 04
Tested backups
Automatic, stored separately, and restored at least once.
- 05
Protect forms
Spam protection and a limit on attempts per minute.
- 06
Few plugins
Every plugin is extra code someone has to maintain.
- 07
Monitoring
Outages and suspicious changes are caught before customers notice.
More notes