Almost every small business website that gets hacked was not attacked through a clever exploit. It was the admin password, an out-of-date plugin, or a cheap shared host.
The admin account is the target
Bots scan the whole internet for login pages and try a few hundred passwords a minute. You do not need a vulnerability for them to try.
- Run one admin account where possible, with a username that is not admin, a generated password of 16 characters or more, and multi-factor authentication.
- Store recovery codes in a password manager.
- Rate-limit the login page and disable xmlrpc.php if you do not use the mobile app. Neither stops a determined attacker, but both remove automated noise.
- Check for admin accounts you did not create. Attackers add a second admin, and login-URL plugins only cut noise.
Plugins, themes, and update discipline
- Remove plugins and themes you are not using. An inactive plugin is still executable PHP sitting where a known flaw can reach it.
- Each is code you do not control, on the request path. Contact form, page builder, membership and file-upload plugins carry the most risk, because they accept public input.
- Check the last-updated date before installing. Anything untouched for a year is a liability.
- Turn on automatic updates for core minor versions, and check plugins monthly. Test a major version on staging, not on the live site.
- Keep PHP current, and never install a nulled plugin or theme. That is how a backdoor lands.
Hosting, SSL, and file permissions
The host is the base of everything.
- Shared hosting means your neighbours share a server. If one is compromised, assume yours is in scope. If you take payments or hold customer accounts, move to managed hosting.
- Use SFTP rather than FTP, a unique database user and password per site, a panel password with 2FA, and turn directory listing off. Permissions should be 755 for directories and 644 for files; 777 means a past compromise.
- SSL is free. Let’s Encrypt issues in about a minute, auto-renews, and works with the free SSL toolkit. Force HTTPS, add HSTS once nothing internal needs HTTP, and fix mixed content, because browsers block assets loaded over plain HTTP.
- If auto-renewal breaks, an expired certificate on a checkout page costs you sales. And SSL is encryption in transit, not a reason to store card numbers yourself: use a gateway.
Backups that survive a compromise
This is where most “we had backups” claims fail. Backups in the same hosting account, or inside the site’s own uploads folder, get deleted or encrypted with everything else.
- Daily database backup, weekly file backup, and at least 14 versions retained.
- Store copies in a different account, ideally with a different provider, using credentials the compromised site cannot reach, plus a known-good baseline.
- Back up files and database together. Defacement is often in the database, so restoring only files changes nothing.
- Test by restoring to a subdomain. A backup you have never restored is a hope, not a plan.
Detection and the first thirty minutes
- File integrity monitoring or a security plugin with change alerts, so new admin accounts and modified core files get noticed.
- Uptime monitoring from outside your host, because a host that is down will not tell you.
- Google Search Console emails you when it detects hacked content, and it is where you request a review after cleaning.
The first thirty minutes: do not delete anything, because you need the evidence and timestamps. Put the site into maintenance mode rather than leaving a defaced page live. Preserve the logs. Change every credential from a machine you trust. Then restore clean, patch the entry point, and ask for a review.
When this barely matters, and what it costs
A static brochure site with no CMS, no forms and no login needs four things: HTTPS, 2FA on the hosting account, 2FA on the registrar, and a monthly glance at the site. A ₹40,000 WAF appliance is not the answer.
| Item | Range |
|---|---|
| SSL certificate | ₹0, auto-renewing |
| WAF or CDN plan | ₹0 - 3,000 per month |
| Managed WordPress hosting | ₹300 - 1,500 per month |
| Security plugin | ₹0 - 4,000 per year |
| One-off hardening and cleanup | ₹5,000 - 20,000 |
The one-off hardening line is usually the best value here.
FAQ
My site was hacked, what do I do first? Do not delete anything. Take the site down, preserve logs, change every credential from a clean machine, restore a known-good backup, patch the entry point, then request a review in Search Console.
Do I need a paid security plugin? Usually not. Free tiers of the major plugins cover firewall rules, login protection and malware scanning. Pay when you need scheduled scans.
Is free SSL really as good as paid? For encryption, yes, it is the same standard. Paid certificates buy extended validation or an organisation badge, neither of which changes how secure the link is.
How often should I update WordPress? Core minor versions automatically. Check plugins monthly, and test a major version on staging first, because most compromises are known plugin flaws, not core exploits.
Should I move off shared hosting? Yes if you take payments, hold customer accounts or run more than a brochure site. It is fine for a small static site, provided the panel has 2FA.
Get it hardened, not just hosted
24Bit System builds and maintains sites through website development services and web hosting services, and the hardening above is a one-off engagement. To see what is publicly reachable on your own site first, scan it with Aegis Inspect. Call +91 7840002466 or contact us.
