A client calls: “our site redirects to some pill shop” or “Google shows a warning that the site is dangerous”. Almost always, the same question follows: “why us?” The answer is unpleasant: nobody chose you. Bots crawl the internet day and night, trying known security holes. Here is how to prevent it and what to do if it has already happened.
How they actually get in
Hacking an ordinary business website is rarely a targeted attack. In the vast majority of cases, the entry point is one of three:
An outdated component. A plugin or theme with a known vulnerability for which a fix has long been available - but the site has not been updated for a year. This is exactly what bots scan for. A weak or leaked password. An admin account with a simple password, or a password leaked in a breach of a completely different site where you used the same one. An abandoned account. A former employee, an old contractor, a test user with admin rights that everyone has forgotten about.
What all three have in common: they are prevented by routine, not by expensive tools.
Prevention: six things that work
Regular updates
Core, theme and plugins - with a backup before every change. It is the most boring and the most effective measure on the whole list.
Strong passwords and 2FA
A unique password for every account, plus two-factor authentication for administrators. It stops every attack that relies on known passwords.
Clean user accounts
Only the people who really need it should be administrators. An editor does not need full rights, and people who have left need none at all.
Fewer plugins
Every unused plugin is an extra door. Deactivated ones too - delete them, do not keep them “just in case”.
Off-site backups
Daily, and stored outside the website’s server. In a serious breach, a backup on the same server is useless.
Firewall and login attempt limits
Limiting failed logins and a basic WAF stop automated attacks right at the door.
Everything on this list is part of a website maintenance subscription - not because it sounds good in a proposal, but because this is the work that prevents the phone call on a Sunday.
How to tell that your site has been compromised
Not every breach is obvious. Sometimes the site looks normal to you but shows something else to visitors coming from Google. The symptoms that should worry you:
Redirects to unfamiliar sites (often only for visitors coming from a search engine, or only on mobile). Strange new pages you did not create - usually in a foreign language, on unrelated topics. A browser warning or an email from Search Console about “suspicious content”. An unknown admin account. A sharp drop in traffic with no other explanation. A site that has suddenly become very slow. Outgoing spam from your domain.
If it has already happened: the first steps
The order matters - panic usually makes things worse.
1. Do not delete anything right away. Make a full copy of the site and the database in their current state. You need it to trace how the attacker got in - otherwise you risk cleaning up the consequence and leaving the cause.
2. Isolate. Put the site into maintenance mode or take it offline temporarily. Every hour online with compromised content adds to the damage to your reputation with Google.
3. Change all access credentials. Passwords for hosting, FTP/SSH, the database and every admin account. With WordPress, you also change the security keys in the configuration - that way all open sessions are ended, including the attacker’s.
4. Find the entry point. Server logs and the dates of modified files reveal a lot. Without this step the cleanup is only temporary - they will come back through the same door.
5. Clean up and update. The core and plugins are reinstalled from clean sources, not “patched”. You also check the places where malicious code hides: uploaded files, themes, scheduled tasks, users.
6. Request a review from Google. If the site has been flagged, request a review through Search Console once it is clean. Regaining trust takes days, sometimes weeks.
Recovering from a breach costs several times more than the yearly maintenance that would have prevented it. And that is only the bill in money - your reputation with customers takes longer to recover.
When restoring from a backup is the answer and when it is not
Restoring a clean backup is the fastest route - provided you know which point in time is still clean. If the breach happened a month ago and your backups only go back a week, you are restoring an infected version. That is why you need both older restore points and logs that show when it started.
The other caveat: restoring brings the site back, but it does not close the hole. Without updating the vulnerable component and changing the credentials, you will be back where you started within days.
The role of hosting
Good hosting does not make a site invulnerable, but it changes a lot: isolation between accounts (on shared hosting, a hacked neighbour should not affect you), daily backups with history, access to logs, server-level scanning and support that actually responds. If you are choosing a new one, see what to look for - security is one of the points that get skipped because of the price.
Conclusion
Almost every breach at a small business comes through an outdated component, a weak password or a forgotten account. Regular updates with backups, 2FA, clean user accounts and off-site copies - that is 90% of your protection. And if it has already happened: copy, isolate, change the credentials, find the way in, reinstall cleanly, request a review from Google.
Suspect something is wrong? Ask us for a quick check of your site’s technical condition, and if you want a person to take a serious look at it, write to us. We have handled enough of these cases to know where to look.
