How does a small shop's website get hacked when there is nothing worth stealing?
Most shop owners think they are not a target. That is only half right. Nobody is aiming at you personally, but automated tools sweep every website on the internet all the time, and what they take is not what you think.
The thing I hear most often when I talk to shop owners about security is: my shop is tiny, there is nothing to steal, who would bother?
That is only half right. It is right that nobody is sitting there targeting your shop personally. It is wrong because most attacks don't start with picking a target.
Nobody picks you. The tools sweep everyone
What runs on the internet all the time are programs that go through every address there is, asking the same questions over and over. Does this site use the plugin with the hole announced yesterday? Is the login page at the standard address? Is there a backup file left out for anyone to download?
It doesn't even know what you sell. It only knows that this door is open. Trying one more website costs it almost nothing. So being a small shop doesn't get you skipped. It just means you don't know how many times you have already been tried.
What they take is not what you are guarding
Shop owners usually think of customer data or the money in the account, which is what matters most to us. In practice, what gets used most often is something we never thought was worth anything.
- Your server. They use it to attack other sites or to mine crypto. You pay for the machine and they use it.
- Your domain name. They hide pages selling illegal goods inside your site, borrowing your domain's good name to rank in search.
- Your ability to send email. They use it to send scam emails in your shop's name.
- Your customer list with phone numbers. They don't use it themselves. They sell it to call-centre scam gangs.
The second one hurts the most, and people notice it last. The site still opens normally and looks exactly the same. Then one day Google puts a red warning in front of your site, and customers who find you in search won't dare to click through again. Getting back to normal takes months.
The three most common ways in
From the sites I have checked, most problems are not complicated. The same few keep coming up.
- Plugins or themes that haven't been updated for a year. The hole has been announced publicly along with how to use it, so anyone can follow along.
- An admin password reused somewhere else. When that other place leaks, your password ends up on the lists people use to try every site.
- Files nobody was meant to see, such as a database backup or a settings file with passwords inside, left where anyone outside can open them.
What you can do yourself today, without hiring anyone
- Turn on automatic updates for your content management system and every plugin.
- Change the admin password to one you use nowhere else, and turn on two-step verification.
- Delete every plugin you don't use. One that is switched off but not deleted can still be a way in.
- Check that every page opens with https, not just the payment page.
- Set up automatic backups and keep them somewhere other than the site itself.
The last one matters more than you think. It doesn't stop you getting hacked, but it turns a hack from a disaster into half a day of lost time.
Summary
Being a small shop doesn't mean you are safe. It means that if you get hit, there is no IT team to help. The good news is that most problems I find can be prevented by doing all five things above, and none of them needs any technical knowledge.