Website Security Gaps Most Small Businesses Miss

Small business websites get broken into the same handful of ways, year after year. It is almost never a targeted attack by someone with a grudge against your company. It is an automated script crawling the entire internet for one specific known weakness, finding your site among a few thousand others, and taking whatever it can reach.

That's good news, in a way. If the attacks are generic, the defences can be too. Here are the gaps we find most often when we take over a site somebody else built, roughly in order of how common they are, and what closing each one really takes.

Plugins and core versions nobody has touched since launch

This is the big one. WordPress runs a large share of small business sites, and plenty of those sites are quietly running plugin versions from three or four years ago. Here's the part people miss: when a plugin author fixes a security hole, the fix gets published, publicly, along with a description of what was wrong. That publication is the starting gun. Scanners now know exactly which version to hunt for and exactly what to do when they find one.

So an unpatched plugin isn't obscure. It's advertised. The fix is unglamorous: switch on automatic updates for security and minor releases, then put twenty minutes in the calendar once a month to review major updates and delete plugins you no longer use. Deactivated plugins still sit on the server and can still be exploited, so remove them rather than switching them off.

Admin passwords a script can guess

Reused passwords are the second most common way in, and they don't require anyone to break anything. If your site admin password is the same one you used on a forum that got breached in 2019, that password is on a list, and the list gets tried against every login form on the internet. Credential stuffing is cheap, automated, and patient.

Two changes fix this permanently. Give every person with admin access a unique password from a password manager, and turn on two-factor authentication for the admin accounts. Most CMS platforms have a free plugin for this and setup takes about ten minutes. While you're in there, check who still has an account. The freelancer who built the site in 2021 usually still has full admin rights.

No HTTPS, or a certificate that quietly expired

A missing or expired SSL certificate does two things at once. Browsers throw a full-page warning in front of your site that most visitors will not click past, and anything typed into your forms travels in plain text. Expiry is the version that catches people out, because the site worked fine yesterday and nobody set a reminder.

Certificates are free now. Let's Encrypt issues them at no cost and any decent host renews them automatically. If yours doesn't, that's a reason to change host rather than a reason to diarise a renewal date. Check today: load your site and confirm the padlock is there on every page, including the ones you rarely visit yourself.

Contact forms that accept anything

A form with no protection is an open pipe into your business. The mild version is spam: a few hundred junk enquiries a week until you stop reading your own inbox and miss a real one. The serious version is injection, where someone submits code rather than a message and the form passes it straight through into your database or your mail system.

The fix is two settings. Add a real bot check such as hCaptcha or reCAPTCHA v3, both free and both invisible to genuine visitors most of the time. Then make sure the form validates and sanitises what it receives on the server, not only in the browser. Browser-side validation is a convenience for honest users; it stops nobody who is sending requests directly to your endpoint.

A login page sitting exactly where everyone expects it

If your site runs WordPress, the login page is at /wp-admin or /wp-login.php unless somebody moved it. Every attacker knows this. It means a brute-force script can start guessing without doing any reconnaissance at all, and on a site with no rate limiting it can try thousands of combinations an hour without anyone noticing.

• Move the login page to a non-obvious address. A plugin does this in a couple of clicks and removes you from the easiest category of target immediately.
• Limit failed login attempts, so an address that gets it wrong five times is locked out for a while instead of allowed to keep going all night.
• Restrict admin access by IP if your team works from a small number of fixed locations. Stricter than most businesses need, and very effective when it fits.

No backups, which turns a bad afternoon into a total loss

Everything above is prevention, and prevention sometimes fails. Backups are the difference between a hack costing you an afternoon and a hack costing you the business's entire web presence. We have met owners who lost eight years of content and every page they had ever ranked for, because the only copy of the site was the one that got encrypted.

You want automatic daily backups stored somewhere other than the server the site runs on, and you want to have restored one at least once so you know the process works. An untested backup is a guess. Most managed hosts include this as standard; if yours charges extra for it, pay the extra and consider it insurance at a very reasonable premium.

None of these are clever attacks. They are the digital equivalent of leaving the shop unlocked overnight, and they persist because once launch day is over, nobody owns the job of looking after the site.

That last point is the real vulnerability. Every fix on this list takes minutes and costs nothing or close to it, and we still find the same six gaps on site after site, because a website gets treated as a project that finished rather than an asset that needs an owner. Pick a person, give them an hour a month, and work down the list. If nobody in the business can be that person, make it part of what you pay your host or your developer for, and get it in writing. The businesses that get hurt are rarely the ones with the most valuable sites. They're the ones where the question of who's watching never came up.