The short answer
Small business sites are rarely compromised by anything sophisticated. They are compromised through outdated components, exposed files and missing basics.
Four checks, all free, catch most of it.
The four checks
| Check | Looking for |
|---|---|
| Certificate and protocol | Expiry, weak configuration |
| Security headers | Missing protections |
| Exposed files | Backups, config, version control |
| Component versions | Known vulnerable versions |
| Admin access | Reachable from anywhere |
Exposed files is the one that produces the worst outcomes. A configuration file or database backup reachable over the web gives away everything at once.
Look for what should not be public
- Configuration files containing credentials.
- Database backups left in the web root.
- Version control directories served publicly.
- Log files with content in them.
- Development or staging copies left reachable.
Point five is common and easily missed. A staging copy with weaker protection and real data is a genuine route in.
Keep components current
Most compromises of small sites exploit known vulnerabilities in outdated software, not anything novel. Keeping platform, plugins and libraries current does more than any other single measure.
Where a component is no longer maintained, that is a decision to make deliberately rather than a status to drift into.
Act on what you find
- Fix exposed files immediately, they are the worst
- Update anything with a known vulnerability
- Add missing headers, which is usually quick
- Restrict admin access where practical
- Schedule the checks rather than doing them once
A scan run once is a snapshot. The value comes from repeating it, since new components and new vulnerabilities arrive continuously.