Your website is one of those things you set up once and then stop thinking about. It sits there doing its job, so there's no reason to touch it. That's exactly why a neglected website is one of the most common ways a small business gets hacked.
Here at Attitude IT, we see this pattern often with the Ontario businesses we work with: a site gets built, it looks great, and then nobody touches it again for years. Most small-business sites run on WordPress, which still powers around 41% of all websites according to W3Techs. WordPress itself is solid. The risk is almost always the plugins and themes added to it, which often don't get updated for years.
Attackers don't usually pick your business by name. They run automated tools that scan huge numbers of websites looking for known weak spots, like a plugin with a security hole that hasn't been fixed. When the tool finds one, it breaks in. It's all automatic, and it isn't aimed at you personally.
That's why old plugins are the problem. When a plugin maker finds a security flaw, they release an update to fix it. Until you install that update, the hole stays open, and the automated scanners know exactly what to look for. Security researchers who track WordPress flaws consistently find that the large majority sit in plugins and themes, not in WordPress itself.
A hacked website rarely announces itself. Instead of shutting your site down, attackers usually keep it running quietly and use it for their own purposes:
The damage lands on you even though the attacker was really after your visitors. Search engines flag hacked sites with warnings and drop them down the rankings, and browsers may block them outright, so customers see a red "this site may be dangerous" screen instead of your homepage.
It depends on how your site is built.
If you use a hosted website builder like Wix, Squarespace, or Shopify, most of the security and updates are handled for you behind the scenes, so your risk is lower. If you have a self-hosted WordPress site — usually set up by a web designer or agency on your own hosting — then keeping WordPress, the plugins, and the themes updated is someone's job. The question is whose.
On a lot of small-business sites, the honest answer is that nobody has touched it since it launched. You can usually tell your site is at risk if you don't know who maintains it, it hasn't been updated in a year or more, or it's running plugins from a developer who has since disappeared.
If your site does get hacked, moving quickly limits the damage:
Common signs are a warning from Google or your browser, a drop in search traffic, pages or pop-ups you didn't add, or your web host getting in touch about a problem. If you're not sure, your IT provider or web host can check.
Yes. A site can look completely normal to you while an out-of-date plugin leaves a door open for attackers. Updates close those holes, which is why they matter even when nothing looks wrong.
Much less so. Hosted builders handle the updates and most of the security for you. You should still use a strong admin password and MFA, but you're not responsible for patching plugins the way a self-hosted WordPress site is.
Someone should own it clearly: your web designer or agency, your IT provider, or your hosting company, depending on your setup. The important thing is that someone is actually doing the updates.
It's a tool that sits on your website, blocks common attacks, watches for changes, and can alert you to problems. On WordPress, a reputable security plugin is a common, low-cost way to add that protection.
If you can't answer "who updates our plugins" off the top of your head, that's worth fixing before it becomes a problem. Attitude IT helps Ontario businesses keep their websites, and everything else, properly maintained — without needing to think about it day to day.