One morning, a real estate office manager opened her website and found it redirecting to a Turkish gambling site. Google had already flagged it as “this site may harm your computer”, and worried customer calls kept coming.

What bothered her most: “Who would even bother hacking a small realtor’s website?”

The answer: nobody bothered. And that is exactly the point.

The hack is not personal

Most small sites are not breached by a hoodie-wearing hacker who chose you. They are breached by bots: programs scanning millions of sites a day for known doors left open - mostly old plugin versions with published security holes.

Why is it worth their while? A hacked site is an asset: spam gets sent through it, fake bank phishing pages get hosted on it, links get planted. Your business doesn’t interest them; your clean address does.

The optimistic conclusion: if the attacks are automated and generic, the defense can be simple and generic too. Five layers, most of them one-time.

Layer 1: HTTPS. The basic lock

If there is no padlock next to your address, you have a double problem: browsers scare visitors with “Not secure”, and Google penalizes rankings. An SSL certificate is free and built into any reasonable host today. Don’t have one? One call to your host fixes it. Have one? Next layer.

Layer 2: updates. The door that stays locked

On WordPress sites this is weakness number one: an old plugin with a known hole is an open invitation to the bots. Two rules: delete every unused plugin (deactivating is not enough), and set automatic updates or a fixed monthly reminder. Nobody to do it? That is exactly the service worth paying for, as we covered in the maintenance-cost comparison.

Layer 3: passwords and login

Bots guess passwords by the millions. Three one-time steps: a long unique password for the site admin (a password manager helps), a username that isn’t admin, and two-factor authentication where supported. Five minutes of work blocks most brute-force attempts.

Layer 4: backups. The safety net

Even with everything locked, things happen. The difference between an annoying glitch and a business disaster is a backup: automatic (not “when I remember”), daily or weekly, and stored outside the site’s own server (a backup sitting on a hacked server gets hacked with it). And once every six months, verify you can actually restore from it. An untested backup is a hope, not a plan.

Layer 5: a foundation with nothing to hack

And here is the chance to think differently: all the layers above exist because a dynamic site has an attack surface - an admin system, a database, plugins. A modern static site has none of that. No login page to guess, no plugins that age, no database to steal. Static files on a global CDN.

That is why the sites we build have no “monthly security checklist” at all. Nothing to update, because there is nothing to hack.

Bottom line

Securing a small business website is not paranoia and not a huge project: it is making sure the door is locked in a world where bots try every handle. HTTPS, updates, a serious password, an external backup - and if you are building a new site, consider a static foundation that takes the whole topic off the table. Two hours of housekeeping today saves that morning with the Turkish gambling site.

Want to know how exposed your site is - or hear about a site with nothing to hack? Talk to us ↗