Most small-business websites are compromised through weak passwords, outdated plugins, missing backups, or open admin panels — not sophisticated zero-days.
Start with HTTPS everywhere, unique admin credentials, and two-factor authentication where available. Keep PHP, CMS plugins, and themes updated on a fixed schedule.
Verify that backups are actually restorable. A backup that fails during an incident is not a backup.
Finally, review file uploads, contact forms, and database queries for injection and spam abuse. Codaphics can run a focused audit if you want a prioritised fix list.
