In short and in plain language
Websites of small firms get attacked too. The attacks mostly run by themselves and hit many sites at once.
The biggest risk is old add-ons that are out of date. Updates for them often exist already.
A lean website with few parts often gives attackers less to work with.
Updates, regular backups, encryption and good login protection lower the risk.
We build your website lean on purpose. If you like, we look after it on an ongoing basis.
A Tuesday morning, just after eight: the owner of a small business opens her website and finds, instead of the home page, a stranger's message and a demand to pay for its release. Overnight, an automated program exploited a known hole in an outdated plugin - not a targeted attack on this particular company, but one of many thousands that probe half the internet every night. Such incidents are no longer a problem for large corporations alone. 43 percent (Accenture) of cyberattacks target small businesses, 64 percent (Hiscox) of small and medium-sized firms experienced at least one attack within twelve months, and in Germany the number of cyber-extortion victims has recently risen by 91 percent (Orange Cyberdefense). The reason is uncomfortable: small businesses are seen as easy targets because their websites are often pieced together with builders and third-party plugins and then barely maintained afterwards. This article explains, in plain terms, why small companies in particular end up in the crosshairs, where the biggest entry points are and why a lean, continuously maintained website offers less attack surface than an overgrown do-it-yourself system. How important regular upkeep is here is explored in the article on why website maintenance matters.
Key takeaways
- Small businesses are attractive targets because attacks run automatically and at scale - not because attackers have singled out one particular company.
- The biggest entry point is outdated plugins, add-ons and builder components for which security updates have long been available but were never installed.
- A lean website with few, well-maintained components typically offers less attack surface than a do-it-yourself system overgrown over the years.
- Ongoing updates, daily backups, encryption and strong login protection noticeably lower the risk - the website at a fixed price from 290 euros, updates and backups on request with care from 19 euros per month.
Why Small Businesses End Up in the Crosshairs
Many owners think: what could an attacker possibly want from my small firm? The answer is sobering - usually nothing personal. A large share of attacks runs fully automatically: programs scan the internet around the clock for websites with known weaknesses and strike the moment they find one. Whether a corporation or a two-person business sits behind it makes no difference to the machine. That is exactly why small businesses are hit so often: 43 percent (Accenture) of attacks are aimed at small companies, and in Germany around one in four (GDV) smaller businesses was recently affected by a cyber incident. Small businesses are not a smaller target - they are an easier one. Where large firms have their own IT departments, the website in a trade business, a practice or a club office often runs on the side, built with a builder and then left to itself. What role the chosen system plays in this is shown in the comparison between your own website and a builder.
Automated Mass Attacks
Attacks run mechanically and at scale. Programs scan non-stop for known holes and hit every vulnerable page - regardless of how small the business behind it is.
Data Has Value
Customer data, credentials and mailboxes can be sold or misused for fraud. Even a small customer list has tangible value for attackers.
Weak Defences
Without a clear responsibility, updates are left undone, passwords are weak, backups are missing. These gaps make small websites a preferred, because easy, target.
A successful attack rarely stays without consequences. The website is offline for days or shows foreign content, customer data falls into the wrong hands, and in the worst case your own server is misused for further attacks. For the economy as a whole this adds up: the digital association puts the annual damage from theft, espionage and sabotage in Germany at around 267 billion euros (Bitkom), and eight out of ten (Bitkom) companies are affected. For a small business, the total figure matters less than its own downtime: lost inquiries, the effort of restoring, trouble with affected customers and, in case of doubt, a reporting duty under data-protection law. Preventing is far cheaper here than cleaning up - and technically far less demanding than many fear.
The Biggest Entry Point: Outdated Software
When small websites get hacked, it is rarely down to sophisticated methods, but almost always to outdated software. Every plugin, every add-on and every builder component is a piece of code in which security holes become known over time. The makers then supply updates - but anyone who does not install them leaves the door open. And attackers know exactly what they are looking for: the Federal Office for Information Security registers around 300,000 (BSI) new malware variants per day on average, and gaining entry through exploited vulnerabilities has recently almost tripled - a rise of about 180 percent (Verizon DBIR) within a year. The more third-party components a website contains, the more such holes can pile up. A builder system grown over years with a dozen plugins is therefore harder to secure than a lean page with few, deliberately chosen parts.
- Outdated plugins and add-ons with publicly known, long-since-closed holes
- Weak or reused passwords that can be guessed automatically
- Missing updates to the content or builder system itself
- No backup, or one never tested, so restoring fails when it counts
- Unencrypted transmission without a valid SSL certificate
- Too many unused components that no one maintains but that stay online
Overgrown Means Vulnerable
Lean Beats Overgrown: Less Attack Surface
The most effective prevention is unspectacular: a website that consists only of what it really needs and is maintained continuously. That is exactly what a lean fixed-price website aims for. Instead of an overgrown builder with many third-party plugins, you get a tidy presence with few, deliberately chosen components - each of them kept current. That reduces the number of possible holes, keeps updates manageable and noticeably lowers the risk, without you having to deal with the technology yourself. With 64 percent (Hiscox) of firms affected, this is no theoretical exercise. Which components belong to your business and what that costs is shown transparently in our overview of services. Security here is not a one-off product but the result of good construction and regular care.
Install Updates Promptly
Security updates for all components are installed regularly and promptly, instead of sitting undone for months. That closes known holes before they are exploited.
Daily Backups
Regular, tested backups ensure the site can be restored quickly if the worst happens - a backup that was never checked may not help when it matters.
SSL Encryption
A valid SSL certificate encrypts the transmission between visitor and server. That protects entered data and is at the same time a signal for search engines and trust.
Strong Login Protection
Secure passwords, a second factor at login and a lockout after failed attempts make automated guessing considerably harder.
Few, Maintained Components
Only build in what is needed: every unused component is a possible hole. A lean page is easier to keep current.
Availability in View
A look at availability and anomalies helps to notice problems early, rather than only when customers get in touch.
Security also includes where a website is hosted and how data is handled. We rely on hosting in Germany and a data-minimal implementation: only what is needed for the purpose is collected, and transmission is encrypted. That lowers not only the technical risk but also makes it easier to meet data-protection requirements. Which basics apply here for small websites is summarised in the article on data-protection basics for the small website. Anyone who also wants to handle visitor consent cleanly will find the answers in the article on whether a small website really needs a cookie banner.
Care Is Not an Extra, but Protection
The 7-Point Check for Your Website
You do not have to be an IT expert to gauge the biggest risks. With a few simple questions you can tell how your website stands - and whether action is needed. Given that 43 percent (Accenture) of attacks target small firms, this look is worthwhile for every business. Go through the following list calmly:
- Are updates installed promptly, or has an update been pending for months?
- Are there daily backups - and has it ever been checked whether they can actually be restored?
- Does the browser show a padlock and https, or is the site reported as insecure?
- Are the passwords strong and unique, or is it the same short password everywhere?
- Is there a second factor or a lockout after several failed login attempts?
- Are components running that no one has used in ages and that no one maintains?
- Does anyone in the business know who is responsible in an emergency and how quickly to react?
Anyone who hesitates on several points has no reason to panic, but reason to act. Much of this can be put in order in a manageable amount of time - either yourself or with support. What a continuously maintained website looks like in practice, and which tasks recur regularly, is described in detail in the article on why ongoing website maintenance matters. Above all, it is important that responsibility is settled: a task that belongs to no one gets left undone.
Test Backups Regularly
Do-It-Yourself or a Maintained Website? The Comparison
| Aspect | Overgrown DIY system | Maintained fixed-price website (Webstart) |
|---|---|---|
| Updates | Often left undone for months | Installed regularly and promptly |
| Components | Many third-party plugins, some unused | Few, deliberately chosen parts |
| Backups | Rarely set up, never tested | Daily, tested backups |
| Login protection | Weak passwords, no second factor | Strong passwords and extra protection |
| Responsibility | Unclear - the task gets left undone | A fixed contact from the region |
| Attack surface | Grows with every extra component | Deliberately kept small |
A do-it-yourself site is not inherently insecure, and a maintained page is no sure thing either - what matters is whether someone takes on the upkeep permanently. This is exactly where the real problem lies for many small businesses: the website is built, goes online and is then left to itself. A lean fixed-price website with optional maintenance flips this logic: few components, clear responsibility, ongoing updates. The result is a site that offers less attack surface in everyday life and keeps your back free. What such a presence looks like for a typical audience is shown, by way of example, in the article on the website for coaches and consultants - the same principles apply to trades, practices or clubs.
After an Attack: React Fast and Correctly
Despite all caution, it can happen. What matters then is to proceed calmly and in the right order, rather than causing more damage in a rush. The first step is to take the site offline or put it into maintenance mode, so that visitors are not endangered and the damage does not spread. After that it is about finding the cause, cleaning up thoroughly and restoring from a tested backup - not simply continuing to use the compromised system. The legal side is part of it too: if personal data is affected, a report to the data-protection authority may be necessary, often within 72 hours. Which mandatory details belong on every commercial website anyway is summarised in the article on the imprint requirement and mandatory details.
- Put the site into maintenance mode or take it offline so no one is endangered further
- Change all passwords - for the system, the database, the hosting and the mailboxes
- Find the cause and remove the malicious code completely, not just the visible traces
- Restore from a clean, tested backup that was created before the attack
- Update all components and remove unused add-ons before the site comes back
- Check whether personal data is affected and keep reporting duties in view
An Honest Classification
Sources
Related Articles
One page or several pages: what a starter site needs
When is a one-pager enough and when does a website need several pages? Three triggers for expanding, figures from Bavaria and a path to grow without a rebuild.
Business registered, no website yet: the first weeks
The trade licence is on the table. Which three pages have to be live in week one, what the imprint takes from your registration papers, and what may wait.
Writing Off Website Costs: How to Book Them Correctly
Build, domain and upkeep are treated differently for tax. What the German Income Tax Act, VAT Act and depreciation tables actually say about each item.