Almost nobody chooses your site to attack. Software finds it, because a plugin was not updated or a password was reused. Website security for small business comes down to what that costs, and which layers are worth paying for.
Website security is not one product. It is a group of separate services sold together: scanning that looks for malicious code, removal that cleans it out, a firewall that filters traffic before it reaches your site, backups you can restore from, and monitoring that tells you when something has changed.
They overlap far less than the packaging suggests. A scanner will not stop a break-in. A firewall will not fix one. A backup will not tell you anything is wrong. Knowing which gap each covers is the whole point of this page.
Worth separating out too: an SSL certificate protects the connection between a visitor's browser and your site and removes the "not secure" label. It says nothing about whether the site is clean, and a site can be perfectly encrypted and thoroughly compromised at once. The files themselves sit on your web hosting, which is what an attacker is reaching for.
The mental picture most owners have is a person deciding to attack their company. That is rarely it. What happens is a program working through millions of addresses looking for one known weakness, finding it on your site, and taking it with no human involved until much later. The way in is nearly always one of these:
What they want is rarely your customer list. It is your server and your reputation: somewhere to send spam from, a hidden page imitating a bank, injected links, or a redirect that only fires for phone visitors. That is why so many owners have no idea. The homepage looks normal on their own screen.
The damage is rarely the hacking itself. It is what happens around it over the following few days.
If your website is a lead source, those are days of enquiries you do not get back.
Security products get sold indiscriminately, so it is worth being clear about where the risk sits.
Even here, keep a backup you have actually restored. Files are lost to mistakes far more often than to attackers.
Read this for the gaps rather than the features. The right answer for most small sites is two or three rows, not all of them.
| Layer | What it protects against | What it will not do |
|---|---|---|
| Malware scanning | Finding injected code, spam links and altered files before a customer or a search engine does. | Prevent the break-in. It is a smoke alarm, not a lock. |
| Malware removal | Cleaning infected files and getting the site off browser and search warning lists. | Close the hole that let the attacker in. An unpatched plugin gets exploited again. |
| Website firewall | Filtering traffic before it reaches the site, blocking common automated attacks and login guessing. | Help once the attacker has a valid password, or patch the software underneath. |
| Backups | Getting the site back to how it was, whatever went wrong: attack, bad update, deleted files. | Save you if nobody ever restore-tested it, or if the only copy sits on the server that failed. |
| Uptime and defacement monitoring | Telling you the site is down or its pages have changed, before a customer phones to say so. | Fix anything. It shortens the time you spend not knowing. |
| Software updates | Removing the vulnerability most compromises depend on. The most effective item here. | Guarantee nothing breaks, which is why updates belong next to backups. |
| Strong unique passwords and two-factor | Stopping a breach somewhere else becoming a takeover of your site. | Anything about vulnerable code, or accounts you forgot exist. |
| SSL certificate | Encrypting the connection between visitor and site, and removing the "not secure" label. | Protect the site itself at all. It secures the road, not the building. |
Which content system, which theme, which plugins, who has an admin login, and where it is hosted. Most people cannot answer all five, and the gaps are usually where the risk is.
A first scan tells you whether you are protecting a clean site or cleaning an infected one. Get that the wrong way round and your first backup preserves the infection.
Put them on a schedule, store them somewhere other than the server they came from, and restore one to a test location. A backup nobody has restored is a belief, not a backup.
The firewall filters traffic before it reaches the site; monitoring watches for the site going down or its pages changing. Both are quick to enable and ask nothing of you afterwards.
Delete admin users who no longer need access, give the rest their own login instead of a shared one, set a unique password on each, and turn on two-factor authentication wherever it is offered.
Someone has to apply plugin and core updates and handle it when one breaks a page. Decide whether that is you, us or an automatic setting. Undecided means nobody.
Switching security products is less disruptive than moving a website, but there is an order that avoids a gap in cover. Overlap the two plans, and cancel the old one only once the new scan, backup and monitoring have each proven they work.
If your domain is at one company, the hosting at another and the security somewhere else again, settle who controls the DNS before the move rather than during it.
WordPress is not insecure. It is popular, and popularity is what attracts automated attacks. The core software is maintained carefully; the risk nearly always arrives through the pieces added on top.
Managed WordPress hosting takes some of this off you, which is the main reason to pick it over an ordinary shared plan.
AldoMedia has been building and maintaining websites for Western New York businesses since 1999, so cleaning up sites that were fine until they were not is familiar work. We are an independent authorised reseller for the security products, and the useful part is the judgement rather than the licence.
We look at what your site runs, say which layers are worth having and which are not, get the backups working and prove they restore, then stay reachable when something looks wrong. If your site has already been flagged, that is a normal call too. Ring 716-771-2536 or describe what you are seeing and we will tell you what state it is in before anybody buys anything. There is more about who we are and what our support covers.
The usual signs are a browser or search warning, a sudden drop in traffic, pages you did not write showing up in a Google search of your own domain, mobile visitors being redirected, or your host contacting you about abuse. Many compromises show nothing on the homepage, which is why scanning exists.
Yes, because they solve different problems. A certificate encrypts the connection and removes the not secure label. It does nothing to stop an out-of-date plugin being exploited. A site can be fully encrypted and fully compromised at the same time.
It depends on three things nobody checks until the bad day: how far back the copies go, whether they are stored away from the server they came from, and whether anyone has ever restored one. A copy that exists only on the same account is lost with the account.
Most infected sites can be cleaned. Rebuilding becomes the sensible option when the software is too old to update safely, when the same site keeps getting reinfected, or when nobody can say what the original files looked like. A clean backup from before the infection usually turns a rebuild back into a restore.
Not directly. There is no ranking bonus for running a scanner. The connection is on the downside: a site flagged as hacked can be labelled in search results or dropped until it is cleaned and reviewed, and recovering that position takes longer than the cleanup did.
Each of these goes further than this page does on one thing.
What a backup has to contain, how to test a restore, where copies should live, and the decisions you face part-way through one.
Read the guideFor a site that is compromised right now. The first hour, how to tell what kind of compromise it is, and getting delisted afterwards.
Read the guideThe hardening checklist in the order things actually bite, starting with the plugin discipline that prevents most of it.
Read the guideThe other half of this subject: what the padlock proves, what it does not, and why every site needs one anyway.
How SSL certificates workWhere your files live, and why the plan you choose changes how much of this you do yourself.
Compare hosting plansQuoted for a security package and not sure it fits? Tell us what the site runs and we will say what is worth keeping.
Ask us to lookBrowse all guides, or read domain name vs web hosting if the pieces still do not fit together.
If you do one thing after reading this, make sure a copy of your site exists somewhere else and that somebody has restored it. Everything else is easier once that is true.
.jpg){kind=link}