When a business owner finds out their website was hacked, the first reaction is usually "But why us? We're not important enough." The honest answer is that it almost certainly wasn't personal. Most attacks are automated. Bots scan millions of websites looking for known weaknesses, and when they find one, they exploit it.
Here are the patterns we see most often, based on sites we've cleaned up over the past couple of years. Details changed, lessons intact.
Story 1: the outdated plugin
A coaching institute's WordPress site started redirecting mobile visitors to a gambling website. Desktop visitors saw nothing wrong, which is why it took weeks to notice.
The cause was a form plugin that hadn't been updated in over a year. A vulnerability in it had been public for months, and bots had found it. They uploaded a hidden file that injected the redirect.
Lesson: Keep everything updated. Remove plugins you don't use. Deactivated plugins can still be exploited if their files are on the server.
Story 2: the "free" premium theme
A small fashion brand's site had a premium theme that their previous developer had downloaded free from a site offering "nulled" (cracked) themes. It contained a backdoor from day one. Two years later, it was used to add hundreds of spam pages that Google indexed, which damaged their search rankings.
Lesson: Never use pirated themes or plugins. The money saved is nothing compared to the cleanup cost.
Story 3: the leftover developer tools
A custom PHP application had a development library left in its public folder from when it was built. A known vulnerability in that library allowed attackers to run code on the server. They installed a web shell, a tool that gave them full control through a browser.
Lesson: Production servers should only contain what's needed to run the site. Development and testing tools should never be publicly accessible.
Story 4: the reused password
A restaurant's admin panel used the same password as the owner's personal email, which had appeared in an old data breach. Someone simply logged in and replaced the homepage.
Lesson: Unique passwords for every account, a password manager, and two-factor authentication on every admin login.
The habits that prevent most hacks
- Update regularly. Platform, plugins, themes, framework packages, PHP version.
- Use fewer plugins. Every plugin is code you're trusting.
- Strong, unique passwords and two-factor login for admin panels, hosting, FTP and domain accounts.
- Use SFTP, not plain FTP. Plain FTP sends passwords unencrypted.
- Off-site backups, tested occasionally by actually restoring one.
- Limit who has access. Remove old employees, freelancers and agencies from admin, hosting and FTP.
- Watch for warning signs: unexpected redirects, unfamiliar admin users, strange files, Google Search Console security warnings, a sudden drop in traffic.
If you think you've been hacked
Don't just delete the obvious bad file. Attackers usually leave several backdoors. Take a full backup of the current state (for investigation), change all passwords, and get someone to compare the site against a known-clean copy. Then find out how they got in, or it'll happen again.
Security for a small website doesn't require an expensive service. It requires boring, consistent habits. Those habits are what keep the bots moving on to someone else.
