Signs your business website is exposed, and what to fix first.

What are the warning signs?

Some signs are visible to anyone. Your browser shows a “Not secure” warning. Pages you never created appear in Google results, often in other languages. Customers report strange redirects, or your contact form sends spam you did not write.

Other signs need a closer look. The site runs a content management system or plugins that have not been updated in months. Several people share one admin login. A former freelancer still has access. An old test copy of the site is still online and showing up in search.

Fix access first

Most break-ins on small sites do not need clever attacks. They use a stolen or guessed password. List every account that can change the website, the hosting, the domain and the email. Give each person their own login, remove anyone who no longer needs access, and turn on two-factor authentication wherever it is offered.

Pay special attention to the domain and email accounts. Whoever controls them can reset almost every other password, so they should belong to the business, not to one person’s private address.

Then updates, backups and forms

Update the platform, theme and plugins, and delete the ones you do not use. An unused plugin is still code that can be attacked. If the site was built by hand, ask who updates its libraries and how often.

Next, check that backups exist, are stored away from the main server, and can actually be restored. Finally, review your forms: they should check what people type, limit repeated submissions and never send sensitive details, such as ID numbers, by plain email.

When is a professional test worth it?

If your site handles logins, payments, bookings or customer records, a penetration test is a sensible step before launch and after major changes. A tester tries to break in the way an attacker would, then gives you a report ranked by risk, with clear fixes. Ask for a retest once the fixes are in place.