Put a website on the internet and within a few minutes something will start knocking on it. Not a person — a script, working through a list of addresses, checking every one of them for the same few hundred known weaknesses. It doesn't know what your business does. It doesn't know your business exists.
This is the part that gets small-business owners into trouble, because the reasonable-sounding thought is: why would anyone bother with us? And the answer is that nobody did bother. Nobody chose you. That is not the same as nobody trying.
Nobody chose you. That is not the same as nobody trying.
What they're actually after#
The other reasonable-sounding thought is we don't hold anything worth stealing, and for most small businesses that's true — there's no customer database worth selling and no card numbers on the server. But your website isn't valuable for what's in it. It's valuable for what it is: a machine on the internet, with an address that people and search engines already trust.
| What they do with it | What you notice |
|---|---|
| Hide spam pages on your domain — counterfeit goods, pills, casinos | Nothing, for weeks. Then your rankings collapse |
| Redirect your visitors somewhere else, but only on phones | Nothing, because it doesn't do it to you |
| Send bulk email through your domain | Your ordinary email starts landing in spam folders |
| Host a phishing page that borrows your reputation | A browser warning on your own site, and an angry host |
| Skim card details, if you take payments | Nothing, until your payment processor calls |
| Lock it and ask for money | That one you notice immediately |
Notice the second column. The version everyone pictures — a defaced homepage, a skull, a ransom note — is the least common and by far the least damaging, because you find out straight away. The expensive ones are quiet by design. A site quietly hosting spam pages for three months does more financial damage than one taken down for a day, and it does it to the thing that's hardest to get back: the trust search engines and email providers have in your domain.
The three doors#
Almost everything that happens to a small-business website comes through one of three openings. Knowing which ones your site has is most of knowing what your risk actually is.
A login page
If people can sign in, so can a script — and it will try, constantly, with lists of passwords leaked from other services. This is why the same password used in two places is the most expensive habit in small business. Every login page on the public internet is being tried right now, including yours.
A database
Anywhere the site stores and reads back what visitors typed. Done properly it's safe; done carelessly, a form field becomes a way to ask the database questions it shouldn't answer. This is decades-old and still routine, because it only takes one form built in a hurry.
Third-party code
Every plugin, theme, extension and embedded widget is software written by someone else, running on your site, with your permissions. Most of it is fine. But when a flaw is announced in a widely-used component, the scripts start looking for it within hours — and they're looking at everyone, which is the whole point of this article.
What actually goes wrong, in order of likelihood#
In practice, small-business sites get into trouble the same handful of ways, and almost none of them are sophisticated:
- A component nobody updated. A flaw is published, a patch ships, and the site is still running the old version six months later because updating it once broke a page and everyone got nervous.
- A password reused from somewhere else. It leaked in a breach at a company you'd forgotten you had an account with, and the same one opens your site.
- An account that should have been closed. The developer from two agencies ago, the marketing intern from 2023, the freelancer who did the photos. Everyone still has keys.
- Something installed to try and never removed. Deactivated is not uninstalled — on most systems the code is still sitting there, still reachable.
- A backup nobody tested. Not how you get attacked, but how a bad afternoon turns into a bad fortnight.
What's worth doing about it#
In rough order of value for effort. The first three cost nothing and cover most of it, which is genuinely the case and rarely said by people selling security.
Do these first
Two-factor on everything that logs in
Your site, your host, your domain registrar, and the email account that can reset all three. Password reuse stops mattering the moment a stolen password isn't enough on its own. This is free and it is the single highest-value thing on this list.
Actually restore a backup
Not check that backups are running — restore one, somewhere private, and see the site come back. Most people discover the state of their backups on the day they need one. Do it once a year and the worst afternoon of your year becomes an inconvenience.
Cut the account list
Write down every person and company who can reach your site, your hosting, your domain and your analytics. Remove everyone who no longer needs it. It takes an hour and it closes the door nobody watches.
Remove what you don't use
Every plugin, theme and embedded widget that isn't earning its place is a door you're maintaining for no reason. Deactivate is not enough — delete.
Patch on announcement, not on schedule
The window that matters is between a flaw becoming public and your site being fixed, because that's when the scripts go looking for it. Monthly update rounds are fine for most things and too slow for the ones that count.
The morning it happens#
The thing that separates an expensive incident from a survivable one is almost never the defences. It's whether anybody knew what to do next. Most small businesses find out their site is compromised from a customer, a browser warning, or a sudden collapse in search traffic — and then spend the first day working out who to call and whether the backups are any good.
So the useful thing to own isn't a product. It's a page of paper: who does what, in what order, with the phone numbers already on it. Who takes the site offline. Who has the hosting login. Where the last known-good backup is and when it was last proven. Who tells customers, and what they're told. Written down before it's needed, because the worst morning of the year shouldn't also be the one you improvise.
The difference between an expensive incident and a survivable one is almost never the defences.
When it's worth paying someone#
Honestly: not always. If your site is a handful of pages, takes no payments, holds no customer details, and has current backups you've actually tested, you're most of the way there and a monthly security plan would be selling you a feeling.
It becomes worth paying for when one of these is true — and if none of them are, we'd rather tell you that on the call:
Worth buying when…
- You take payments or hold customer details through the site
- A customer, an insurer or a larger client has started asking, in writing, how the site is secured
- The site runs on a system you've lost track of — nobody knows what's installed or who has access
- You'd have no idea what to do first if it went down dirty on a Sunday
- The site being offline for two days would cost real money
What that buys, in our case, is deliberately unglamorous. Every site we build ships with the headers, the encryption, the cookie handling and the keys already done — not as an upgrade, because a site that goes live without them isn't a site awaiting an upgrade, it's a site missing something it should have left with. Care Plus at $199 a month keeps that true as new flaws are announced — patched the day a flaw is published rather than at the next update round, scanned every week, with the firewall and the headers kept current. Care Complete adds the written runbook, a quarterly look at who can still reach your site, and a security section in the monthly report. There is no security package to buy on top, and there used to be — we retired it, because a plan sold separately asks you to make a second decision about a risk you don't believe you have, and the businesses that most need it are exactly the ones who decline. All of it sits on a plan we host, because we won't promise to defend a site we don't run — a security plan on infrastructure somebody else controls is a promise about somebody else's work, and we'd rather migrate you onto ours than pretend otherwise.
Related reading: what a care plan actually pays for, where patching is the line item that varies most, and WordPress vs custom code, which is the longer version of the three-doors argument.