If you run a small business, it is easy to think nobody would bother hacking your website. You are a plumber, a salon or a cleaning company, not a bank. Why would anyone care?
The honest answer is that nobody is targeting you personally. Most attacks on small websites are not carried out by a person sitting at a keyboard. They are carried out by automated programs, often called bots, that crawl the internet all day looking for any site with a known weakness. When a bot finds one, it gets in. It does not care whose site it is.
The upside is that most break-ins come from a few common, fixable problems.
Why small sites get targeted
Bots scan millions of websites looking for the same handful of weak spots. A small site is attractive because it is often looked after less closely than a big one. Once a bot is in, your site can be used to:
- Send spam emails from your domain
- Host hidden spam pages to game Google
- Redirect your visitors to dodgy websites
- Store files or run software for someone else
- Steal any customer details stored on the site
None of that requires your business to be important. It only requires your site to be unlocked.
Out-of-date software and plugins
This is the biggest cause. Many small business websites run on a content management system, which is the software that lets you edit pages without writing code. WordPress is the best known. On top of that sit plugins, which are small add-ons for things like contact forms, galleries or booking tools.
All of this software gets security updates. When a weakness is found, the developers fix it and release a new version. The problem is that the fix also tells the world where the weakness was. Bots are then updated to look for sites that have not installed the fix yet.
If your site has not been updated in months, it may be running software with publicly known holes in it. The same applies to the software underneath, such as PHP, the programming language many sites run on. Our post on the PHP2Shell PHP security flaw explains how one of these problems works in plain English.
Weak or reused passwords
Bots also try to log in to your site by guessing passwords. They run through lists of common passwords and leaked passwords from other websites, thousands of times over.
If your password is short, a common word, or something you use elsewhere, there is a real chance it is already on one of those lists. Reused passwords are especially risky. If a shop or forum you once signed up to is breached, the email and password pair you used there gets tried on everything else.
Abandoned admin accounts
Over the years, a lot of people may have been given access to your website. A web designer from years ago. A nephew who helped with the photos. A former member of staff. A marketing agency you stopped using.
Every one of those accounts is a door. If any of them has a weak password, or belongs to someone whose email has since been compromised, it can be used to get in. Nobody uses them, so nobody notices them.
Cheap or nulled themes and plugins
A theme controls how a website looks. Premium themes and plugins cost money, and some sites offer them for free as cracked or "nulled" copies. Nulled means the licence check has been removed so it can be used without paying.
These copies very often come with hidden extras added in, such as a back door that lets someone log in later, or code that injects spam links. If a theme or plugin is being given away for free when it normally costs money, assume there is a catch.
Insecure or neglected hosting
Hosting is the service that stores your website and makes it available online. Very cheap hosting can mean old server software, poor separation between the websites sharing a server, and no backups. If one site on a shared server is compromised, a badly set up server can let the problem spread.
Look for hosting that keeps its own software up to date, includes an SSL certificate (the padlock in the browser bar, which encrypts information sent between your visitors and your site), and takes regular backups you can actually restore.
What you can do about it
The fixes are not glamorous, but they work.
- Keep your website software, theme and plugins updated, ideally weekly.
- Delete any plugins or themes you are not using.
- Use a long, unique password for your website login, stored in a password manager.
- Turn on two-factor authentication wherever it is offered.
- Remove admin accounts for anyone who no longer needs access.
- Only install themes and plugins from the official source or a reputable developer.
- Choose hosting that includes updates, an SSL certificate and regular backups.
If that feels like a lot alongside running a business, that is normal. It is why we built our monthly plans at We are Graft so that hosting, security updates and backups are handled for you, with no logins to lose and nothing to update yourself. You can see what each plan covers on our pricing page.
The short version
Small business websites are rarely hacked because someone has a grudge. They are hacked because a bot found an unlocked door. Keep things updated, keep passwords strong and unique, clear out old accounts and avoid anything that looks too good to be true.
If you would like a hand checking where your site stands, or you are thinking about starting fresh with a site that is looked after properly, get in touch and we will reply within one working day.