Synergy team
Small business websites are not hacked because someone needs you specifically. They are found by automated scanners walking through thousands of addresses in search of a known vulnerability. Your site ends up in the sample not by importance but by a matching module version.
The short answer
Basic protection is five things: timely updates, strong passwords with two-factor authentication, off-server backups, HTTPS, and limited access rights. Together they close the overwhelming majority of automated attacks.
Five basic measures
Updates
Vulnerabilities in popular CMSs and plugins are published openly. Days pass between publication and mass scanning. A site that has not been updated for six months is vulnerable by definition.
Passwords and two-factor authentication
A password like `admin123` is guessed in seconds. Two-factor authentication on the admin panel closes password guessing entirely, even if the password has leaked.
Backups
A backup is not there "just in case" — it is the only fast route to recovery. The conditions: regularity, storage away from the same server, and a check that the copy actually restores.
HTTPS
A certificate encrypts data between the visitor and the site. Without it, passwords and form data travel in the clear and browsers mark the site as insecure.
Limiting rights
Each employee gets their own access with the minimum rights required. One shared administrator login for the whole company means no control over who changed what.
Shared admin access is worse than a weak password: a weak password can be changed, but with a shared login it is impossible to establish who deleted a page.
What strengthens protection further
| Measure | What it gives |
|---|---|
| WAF (application firewall) | blocks common attacks before they reach the site |
| Login attempt limits | stops password guessing |
| File monitoring | reports changes to site files |
| Regular password rotation | reduces risk from old leaks |
| Separate staging and production | mistakes never reach the live site |
What to do if the site is compromised
- Restrict access to the site so visitors do not land on infected pages.
- Change every password: hosting, panel, database, FTP, mail.
- Restore from the last clean backup rather than "fixing" the current version.
- Find the entry point — otherwise the breach repeats within days.
- Update everything and close the vulnerability that was used.
Order matters: restoring without finding the cause delivers a second breach through the same door.
Personal data
If the site collects enquiries, you process personal data and fall under Law No. 133/2011 and the requirements of the NCPDP. A leak is not only a technical problem but a legal liability. The minimum: HTTPS, restricted access to enquiry data, and a retention period.
More on what a site needs legally: what full-cycle website development includes.
Frequently asked questions
Does a website need antivirus?
A separate "antivirus" matters less than updates and backups. File change monitoring helps but does not replace the basics.
Is the hosting provider's protection enough?
Hosting is responsible for the server, not for your code and modules. A plugin vulnerability is your area of responsibility.
How often should backups run?
For a brochure site, weekly. For an online store, daily, together with the database.
Can a custom-built site be hacked?
Yes, if it contains flaws. Custom code lands in mass scanners less often, but that is a delay, not protection.
Who should handle all this?
Either your own technical specialist or a technical support contractor. What matters is that it is someone's standing responsibility.
Conclusion
Website security is not a one-time setup but regular work: updates, backups, access control. All five basic measures take a few hours a month and cover most attack scenarios.
Synergy includes updates, backups and monitoring in every technical support package.
We will check your website for free
We show the growth points before any work starts — no obligations
Get a free audit
