Introduction

Most business owners think of a website hack as something that happens to large companies. In reality, most attacks on websites are automated. Software scans millions of websites every day, looking for an outdated plugin, a weak password or a misconfigured server. It does not care whether the website belongs to a multinational or a family business in Kandy. If the weakness is there, the attack is attempted.

The consequences for a small business can be serious: a website that redirects customers to scam pages, a Google warning that scares visitors away, an online store that leaks customer details, email that lands in spam because the server was used to send junk, or a website that simply disappears with no recent backup.

The good news is that most of these attacks are preventable, and the damage from those that succeed can be limited. This article explains how websites are attacked, the layers of protection that stop most attacks, how to plan backups and recovery, why monitoring matters, and what a managed website care plan from Dsigngo Group and Raiden (Pvt) Ltd includes.

How websites are attacked

Understanding the common methods helps explain why each protection matters.

Exploiting known weaknesses

Software, including WordPress plugins, themes, content management systems and server software, sometimes contains security flaws. When a flaw is discovered and published, attackers quickly build tools to exploit it, and websites that have not been updated become targets. Verizon’s 2025 Data Breach Investigations Report found that the exploitation of vulnerabilities was the first step in about 20% of breaches, up 34% on the year before. Prompt updates are one of the most effective protections available.

Stolen or guessed passwords

Attackers try common passwords, passwords leaked from other websites and automated guessing (“brute force”) against login pages, control panels, email and file transfer accounts. Credential abuse remains one of the most common ways into systems.

Malicious uploads and injected code

Weak forms and plugins can let attackers upload files or inject code into a website or its database. The code may redirect visitors, show spam, steal payment details from checkout pages or hide a “back door” for later access.

Pirated themes and plugins

“Nulled” or pirated copies of premium themes and plugins are a common source of hidden malware. They save a small licence fee and can cost far more.

Third parties and integrations

Websites connect to payment gateways, marketing tools, chat widgets and other services. Verizon’s 2025 report found that the share of breaches involving a third party doubled to about 30%. Every integration and every person with access is part of the security picture.

Denial of service

Some attacks try to overwhelm a website with traffic so that real visitors cannot reach it. Network protection and content delivery networks absorb or filter much of this traffic.

Layers of protection

No single tool makes a website secure. Good security uses several layers, so that if one fails another still protects the site.

1. A secure, isolated server

The hosting platform is the foundation. Servers should be hardened to a secure baseline, with unnecessary services removed, operating system and server software kept up to date, and each hosting account isolated so that a problem on one website cannot spread to others.

2. A firewall

A network firewall blocks unwanted connections to the server. A web application firewall (WAF) inspects website traffic and blocks known attack patterns, such as attempts to inject code or exploit common plugin flaws, before they reach the website.

3. Login protection

Limits on login attempts, blocking of known malicious addresses, strong password rules and two-factor authentication protect administrator accounts, control panels and email. Each person should have their own account, with only the access they need.

4. Updates

Content management systems, themes, plugins, PHP and server software must be kept up to date. Security updates for actively exploited flaws should be applied as soon as possible. Our WordPress and WooCommerce hosting guide describes a safe update routine for WordPress.

5. Malware scanning

Regular scans check website files and databases for known malware and suspicious changes. When something is found, it must be investigated and cleaned, and the way it got in must be closed.

6. HTTPS everywhere

Every website should load over HTTPS, with a valid TLS certificate that renews automatically. HTTPS protects contact forms, logins and payments from being read or changed in transit. As certificate lifespans shorten, falling to 200 days from March 2026 and to 47 days by 2029, automatic renewal is essential. Our article on the SSL certificate changes explains the change.

7. Backups

When prevention fails, backups are how you recover. They are covered in detail below.

8. Monitoring and response

Monitoring watches for downtime, unexpected changes and suspicious activity, and alerts a team that can respond. A quick response limits damage.

Planning backups that actually work

Almost every hosting plan claims to include backups. The real questions are what is backed up, how often, where the copies are kept, for how long and how quickly they can be restored.

What to back up

• Website files, including themes, plugins and uploaded images and documents.
• Databases, which hold pages, products, orders, customers and form entries.
• Email, if it is hosted on the same server.
• Configuration, such as server settings and DNS records, so the setup can be rebuilt.

How often

The right frequency depends on how quickly the website changes. A company website updated once a month can be backed up daily. An online store taking orders all day needs more frequent database backups, because a daily backup could lose a day of orders. Ask yourself how much data you could afford to lose, and set the backup frequency accordingly.

Where

Backups stored on the same server as the website can be lost if the server fails or is compromised. Copies should be stored in a separate location. The well-known 3-2-1 rule recommends three copies of your data, on two different types of storage, with one copy off-site.

How long

Some problems, such as hidden malware or a mistake that nobody notices, are discovered days or weeks later. Keeping backups for several weeks means you can restore to a point before the problem began. We take automatic daily backups of every website, database and mailbox. They are kept for 30 days (14 days on Business Starter) and stored in a separate data centre, and cloud servers can add hourly database backups.

Testing restores

A backup is only useful if it can be restored. Restores should be tested from time to time, so that when a real emergency comes, the process is known and works.

What to do if your website is hacked

If a website is compromised, act quickly and carefully:

1. Contain it. Put the website into maintenance mode or take it offline if it is harming visitors.
2. Change passwords for the hosting account, website administrators, database, file transfer and email, and turn on two-factor authentication.
3. Find out how the attacker got in, for example an outdated plugin or a stolen password. Restoring a backup without closing the hole often leads to reinfection.
4. Clean or restore. Remove the malicious code, or restore a clean backup from before the attack, then apply all updates.
5. Check for data exposure. If customer data may have been accessed, consider your legal obligations, including those under Sri Lanka’s Personal Data Protection Act, whose key provisions take effect on 1 January 2027. Take legal advice where needed.
6. Request a review from Google if the site was flagged as dangerous, once it is clean.
7. Learn from it. Strengthen the weak point so the same attack cannot work again.

Our team handles these steps for managed hosting clients.

Uptime monitoring

Uptime monitoring checks your website from outside at regular intervals, usually every minute or few minutes, just as a visitor would. If the site does not respond, or returns an error, the monitoring system alerts the support team.

Good monitoring also checks:

• That specific pages, such as the checkout, load correctly, not just the home page.
• How quickly the server responds, so slowdowns are spotted early.
• SSL certificate and domain expiry dates.
• Server resources such as disk space, memory and CPU.

Without monitoring, the first sign of a problem is often a customer’s phone call, or lost orders that nobody notices until the end of the month.

Website care plans: what they include

A website care plan, sometimes called a maintenance plan, combines hosting management with regular care for the website itself. It suits businesses that want their website looked after without managing it themselves. A complete care plan should include:

• Managed updates of the content management system, themes and plugins, with a backup first and checks afterwards.
• Security monitoring and malware scanning, with clean-up if something is found.
• Backups with tested restores.
• Uptime and performance monitoring, with alerts to the support team.
• SSL and domain renewal management.
• Monthly reports showing updates applied, backups, uptime and any issues.
• A set amount of support time for small content changes, fixes and advice.

Our website care plans (prices in Sri Lankan rupees, per month, excluding VAT):

The support hours match Raiden’s Essential Care, ProSecure and Enterprise Shield maintenance plans.

Security responsibilities: who does what

Security is shared between the hosting provider and the website owner. Being clear about responsibilities avoids gaps.

With a managed care plan, we take on most of the website owner’s technical tasks, leaving you to manage your content and your team’s access.

Data protection and your website

Many websites collect personal data through contact forms, quotation requests, newsletter sign-ups, accounts and orders. Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, sets rules for how such data is collected, used, protected and kept, and its key provisions take effect on 1 January 2027. Practical steps for website owners include:

• Collect only the personal data you need.
• Protect forms and accounts with HTTPS and strong security.
• Limit who can see form entries and customer records.
• Delete data you no longer need, including old form entries in the website database.
• Publish a clear privacy notice.
• Make sure backups containing personal data are protected.

This is general information, not legal advice. For your specific obligations, consult a qualified lawyer.

Extra protection for online stores and forms

Websites that take orders, payments or personal details need extra care, because they hold exactly what criminals want.

• Keep card details off your server. Use a payment gateway that collects card details on its own secure page or fields, so your website never stores them.
• Watch the checkout. Some attacks add hidden code to checkout pages that copies card details as customers type them. File change monitoring and regular malware scans help detect this quickly.
• Protect forms from spam and abuse with tools that block automated submissions, and limit the file types and sizes that forms accept.
• Separate customer accounts from administrator accounts, and never give customers more access than they need.
• Send order emails through an authenticated mail service, so attackers cannot easily imitate your order confirmations.
• Delete old data. Abandoned carts, old form entries and expired accounts are a risk with no business value.

Building good security habits in your team

Technology stops most attacks, but people still matter. Many incidents begin with a staff member reusing a password, clicking a phishing link or sharing an account. Simple habits reduce the risk:

• Give every person their own login, with only the access their role needs.
• Use a password manager and two-factor authentication for website, hosting, domain and email accounts.
• Remove access the same day someone leaves, including freelancers and agencies.
• Be suspicious of urgent emails about domain renewals, hosting suspensions or payment changes, and check them through a known contact.
• Report anything unusual, such as unexpected password reset emails or strange pages on the website, straight away.
• Keep a list of who has access to what, and review it every few months.

Illustrative example

The following example is illustrative and does not describe a real client.

A private school’s WordPress website began redirecting some mobile visitors to a gambling website. Parents reported it, and Google showed a warning on search results. The site had not been updated for over a year, and several plugins had known weaknesses.

Under a care plan, the response took a day. The site was placed in maintenance mode, all passwords were changed and two-factor authentication was enabled for staff. The investigation found that an outdated slider plugin had been exploited. A clean backup from before the infection was restored, the plugin was replaced, and all software was updated. A firewall with WordPress rules was enabled, and malware scanning was scheduled daily. Google’s warning was removed after a review request.

The school now receives a monthly report of updates, backups and uptime, and the website has stayed clean.

How Dsigngo Group and Raiden keep websites secure

Our sister company, Raiden (Pvt) Ltd, provides cybersecurity, server administration and data recovery services for businesses across Sri Lanka and the UAE. Dsigngo Group’s web team builds and maintains websites. Together, we protect both the server and the website on it.

Our managed security and care services include:

• Hardened, isolated hosting with a firewall and web application firewall.
• Login protection and two-factor authentication.
• Managed updates with backups before and checks after.
• Daily malware scanning and clean-up.
• Automatic SSL renewal.
• Automatic off-site backups with tested restores.
• Around-the-clock uptime monitoring and alerts.
• Monthly reports.
• Support from our own team by phone, email, chat and remote access.

Raiden’s clients sign confidentiality forms as part of its support agreements, and the same care for client data applies to our hosting.

Frequently asked questions

Is my small business website really a target?

Yes. Most attacks are automated and look for weaknesses, not for particular companies. Small websites are often targeted because they are less likely to be updated and monitored.

Do backups protect me from hackers?

Backups let you recover after an attack, but they do not prevent one. You also need updates, a firewall, strong passwords and monitoring. Backups should be stored away from the server and kept long enough to restore to a time before the attack.

How often should my website be updated?

Check for updates at least weekly, and apply security updates for serious, actively exploited weaknesses as soon as possible. A care plan handles this for you.

Can you clean a website that has already been hacked?

Yes. We contain the problem, find how the attacker got in, clean or restore the website, apply updates and strengthen security so it does not happen again.

What is included in your monthly report?

The report lists updates applied, backups taken, uptime, security scan results and any issues we fixed, with recommendations where something needs your attention.

Conclusion

Website security is not one product but a set of habits: secure hosting, a firewall, strong login protection, prompt updates, malware scanning, HTTPS, reliable off-site backups and constant monitoring. Together, these stop most attacks and allow fast recovery from the rest.

Dsigngo Group and Raiden (Pvt) Ltd provide managed hosting and website care plans that put all these layers in place, with a local team that responds when something goes wrong.

Want peace of mind? Ask us for a free website security check.

Get a Security Check

Sources

• Verizon, 2025 Data Breach Investigations Report (vulnerability exploitation and third-party involvement): https://www.verizon.com/business/resources/reports/dbir/
• CISA, Data Backup Options (3-2-1 approach): https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf
• OWASP Foundation, OWASP Top 10 web application security risks: https://owasp.org/Top10/
• CA/Browser Forum Ballot SC-081v3, TLS certificate validity reductions (summary): https://support.dnsimple.com/articles/announcement-ssl-certificate-validity-changes/
• Daily FT, “Data protection compliance regime takes effect on 1 Jan. 2027″: https://www.ft.lk/front-page/Data-protection-compliance-regime-takes-effect-on-1-Jan-2027/44-795776
• Google Search Central, Hacked sites and security issues: https://developers.google.com/search/docs/monitor-debug/security
• Raiden (Pvt) Ltd company profile and AMC booklet (cybersecurity, data recovery and confidentiality): https://www.raiden.lk