55 Park Road, 
When people hear “small business website security”, they picture hackers going after big corporations. In my experience it’s the opposite — it’s the small, forgotten websites that get hit. And it usually starts with the same phone call.
Every few months a new enquiry lands, and it’s the same call. “The website’s acting weird.” Or worse — the owner only found out because one of their own customers rang in, rattled that Google was throwing a big red warning across the site before it even loaded.
So we go digging, and it’s almost always the same story underneath.
The pattern I see again and again
Nearly every small business website security problem I see starts the same way: the site was built years ago by someone who’s long since moved on. It launched, everyone admired it, and then… nothing. No updates. No backups anyone has ever actually tested. Half a dozen admin logins floating around, and no one can tell you who still has the keys. It’s been sitting there quietly rotting while everyone assumed it just works.
And it did work — right up until someone on the other side of the world noticed it was an easy target and walked straight in through a hole that had been fixable for ages.
Here’s the part worth sitting with: nobody neglects their website on purpose. A website doesn’t ping you. It doesn’t throw a check-engine light. It just sits there looking fine on the surface while the foundations go soft. By the time the problem is obvious, the damage is already done.
Your website is infrastructure, not a project
Most people treat a website like a one-off project — build it, launch it, tick the box. But a website is closer to a work ute. You don’t drive it for five years without ever checking the oil and then act surprised when it dies on the freeway. It’s infrastructure you own, and infrastructure needs maintenance. The good news is that the maintenance is boring and cheap — far cheaper than the cleanup after a breach. And that is the heart of small business website security — treating the site as something you maintain, not something you finish.
Why small business website security matters right now
This isn’t just a general nag. A serious flaw was just found in PHP, the software that runs a huge chunk of the world’s websites — one that lets an attacker run their own code on the server with no password at all. The fix only landed this week, and the Australian Signals Directorate has already issued an alert on it.
Plenty of hosting providers are still catching up. Don’t assume yours has sorted it, and don’t assume anyone is going to chase it up on your behalf. (If you run your own stack, the technical detail is at the bottom of this post.)
The 5 small business website security basics that cover you
- Keep everything updated — the core platform, the theme, and every plugin. Remove anything you’re not using.
- Keep real backups you’ve actually tested restoring — not just “the host probably has one.”
- Turn on two-factor authentication for every admin login.
- Have something genuinely watching the site — a security plugin or monitoring service, not hope.
- Review who still has access at least once a year, and clear out the logins that shouldn’t be there.
None of this is me being precious. It’s essentially the ASD’s own baseline advice — the Essential Eight (now evolving into its new Essentials series) — boiled down to a single website: patch it, back it up, lock down the logins, and know who has the keys. The national cyber agency has been banging this drum for years, and weeks like this one are exactly why.
What website neglect actually costs
When a small business website gets compromised, the damage rarely stops at the site itself. Google flags it, so your rankings slide and visitors see a warning before the page even loads. Your email can start landing in spam folders if the domain picks up a bad reputation. And if attackers are skimming your contact forms, customer details may be exposed — which, depending on what you collect, can trigger notification obligations under Australian privacy law.
Then there’s the cleanup. Doing it properly means finding every backdoor rather than just the obvious one, disinfecting or rebuilding files, rotating every password, and watching for reinfection for weeks afterwards. It’s slow, it’s stressful, and it almost always costs more than the quiet maintenance that would have prevented it in the first place.
How to tell if your site is already at risk
You don’t need to be technical to spot the warning signs. Open your dashboard and see how many updates are sitting there waiting. Ask when your last backup was actually tested — not just created. Count how many people still have admin access, and whether any of them have left the business. If you can’t answer those three questions confidently, the gaps are almost certainly there — and that uncertainty is exactly the state attackers rely on.
None of this means becoming a security expert overnight. It just means treating your website like the business asset it is — something worth a few minutes of attention each month, or a provider who quietly does that for you.
Not sure where your site stands?
If you can’t remember the last time any of the above happened on your website, that’s your answer. Good small business website security isn’t complicated — it’s just consistent. At Sydney Technology Solutions we can take a look, tell you honestly where the gaps are, and sort them before they become a problem. It’s a lot cheaper than the cleanup.
Small business website security FAQs
How often should a small business website be updated?
Check for updates to your platform, theme and plugins at least monthly, and apply security updates as soon as they’re released. Many hosts and managed providers can apply these automatically, which stops a critical patch from sitting unapplied for months — which is exactly how most sites get compromised.
Do I really need my own backup if my host says they have one?
Yes. A host backup protects their infrastructure, not your site, and it’s often the first thing people find doesn’t actually restore when they need it. Keep your own backup, stored separately from the site, and test restoring it at least once so you know it works before an emergency.
What’s the single most important small business website security step?
If you only do one thing, turn on two-factor authentication for every admin login. Most break-ins start with a guessed, reused or leaked password, and two-factor stops an attacker cold even when they have it. It takes a few minutes and it’s free on almost every platform.
How do I know if my website has already been hacked?
Common signs include unexpected redirects, spam pages or pop-ups you didn’t create, a sudden drop in rankings, browser or Google warnings, and your host suspending the account. If you spot any of these, put the site into maintenance mode and get it looked at straight away — the longer a compromise sits, the further it spreads.
For the technically inclined: this is PHP2Shell (CVE-2026-109618 / CVE-2026-109619), two unauthenticated remote-code-execution flaws rated 9.2 that affect virtually every PHP version back to 5.4. Patches landed this week in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 — update and restart on those branches now. If you’re on an end-of-life branch (8.1 or older) there’s no official fix in your version line; it’s time to move to a supported release.
