“Why would anyone bother hacking us? We are a five person company in a town of nine thousand.”
Because nobody chose you. A script is working through every site it can reach, testing for a short list of known weaknesses, and yours answered. The attacker does not know your name and will never look at your site. It is closer to a burglar walking down a street pulling on door handles than to anyone deciding to break into your house.
That reframing matters, because it tells you what actually protects you: not being obscure, but not having an unlocked door.
How they get in
Out of date plugins, themes, and core software. This is the majority of cases, and it is not close. Somebody publishes a security fix for a popular plugin. The fix describes the flaw. Within hours, scanners are testing every site on the internet for the old version. Sites that update within a week are fine. Sites running a version from 2023 are found automatically.
Abandoned plugins. Worse than out of date, because no fix is coming. A plugin whose author stopped updating it three years ago is a permanent open window. Check the last updated date on everything you run.
Weak or reused passwords. An administrator account with a password used on another site that was breached. The credentials are in a list, the list gets tested against every login form, and eventually it works.
No two factor authentication. Which turns a correct password into full control rather than one of two required steps.
Too many administrators. The designer from 2019, the intern, the marketing agency you stopped using. Every one of those is another account that can be compromised on your behalf.
Nulled themes and plugins. Paid software cracked and given away free. The crack is the payload. This is not an accident waiting to happen, it is a backdoor you installed deliberately.
A neighbor on shared hosting. On cheap shared hosting, a compromise of another account on the same server can sometimes reach yours. Less common than it used to be, still real.
What they do once they are in
Rarely anything dramatic. Defacement is old fashioned and unprofitable.
Spam pages. Hundreds of hidden pages selling pharmaceuticals or counterfeit goods, linked from nowhere visible, existing purely to rank in Google using your domain’s reputation. You find out when a customer searches your business name and sees something alarming.
Cloaked redirects. Visitors from search get sent to a scam site. You, typing your address directly, see your normal homepage. This is why the owner is usually the last to know.
Card skimming. On a site that takes payments, a few lines of injected code copying details as they are typed. This one has legal and financial consequences well beyond the website.
Mail relay. Your server sends spam. Your domain’s reputation collapses, and suddenly your quotes stop arriving in customers’ inboxes.
A quiet backdoor. Sometimes they do nothing at all for months, keeping access for later or renting it out.
How you find out
In roughly this order of frequency: Google flags the site in search results or the browser shows a red warning; your host suspends the account; a customer tells you something looks wrong; your email starts bouncing; you notice yourself.
Turn on Search Console if you have not. It emails you about security issues, and it is often the fastest warning you will get.
What actually prevents it
Update things, on a schedule. Once a month, and within a couple of days for anything flagged critical. This single habit prevents most of what happens to small sites.
Two factor on every administrator account. Free, ten minutes, and it defeats the entire category of stolen password attacks.
Fewer plugins. Every one is code you did not write, from someone you do not know, running with full access. Removing a plugin you are not using is a security improvement, a performance improvement, and free.
Delete accounts people no longer need. And give the ones that remain the lowest role that lets them do their job. A person who writes blog posts does not need administrator.
Backups you have actually restored. An untested backup is a belief, not a plan. Restore one to a test location once, so you know it works and how long it takes.
Keep your own machine clean. Credentials stolen from an infected laptop are a genuinely common route in, and no amount of server hardening helps.
A web application firewall. Worth having, and it is a layer rather than a solution. It buys you time between a flaw being published and you applying the update.
If it has already happened
Do not just delete the bad pages. They will come back, because the way in is still open and there is almost certainly a backdoor left behind. Cleaning the symptom is how businesses get reinfected three times in a month and conclude that hacking is unstoppable.
Take it offline or into maintenance mode, so you are not serving malware while you work.
Change every credential. Hosting, database, content system, FTP, and the email account that can reset all of them.
Restore from a backup that predates the compromise, if you can pin down when it happened. Then update everything before putting it back online, because restoring to the same vulnerable state invites the same script back.
If you cannot be confident it is clean, rebuild it. On a small site this is often faster and always more certain than hunting for every injected file.
Then request a review. In Search Console, under Security Issues, once you are genuinely clean. Getting the warning removed takes days, not hours, which is a good reason to have taken the boring monthly update seriously.
The proportionate version
You are not defending a bank. You are making your site a slightly harder target than the thousands of others the same script is testing this hour.
Updates on a schedule, two factor on the admin accounts, a short list of plugins, no stale logins, and a backup you have restored once. That is most of the risk gone, and none of it costs anything but the half hour a month.
