A website feels like a finished thing. You sign it off, it goes live, it looks great — and then, understandably, you go back to running your business. Months pass and nothing appears to change, so nothing seems to need doing.
The trouble is that a website isn't really one thing. It's a stack of separate pieces of software — the platform, the theme, a dozen or so plugins, the server it all sits on — and every one of those pieces keeps moving whether you're watching or not. Here's what that actually means in practice, and what a sensible level of care looks like.
The parts underneath keep changing
Most small-business websites in Australia run on WordPress, and WordPress is really a small core plus a pile of add-ons: your contact form, your booking system, your image gallery, your SEO tool, your payment gateway.
Each of those add-ons is built by a different team, on a different schedule, with different levels of care. Patchstack, which tracks security flaws across the WordPress ecosystem, recorded 11,334 new vulnerabilities in 2025 — a 42% jump on the year before. Of those, 91% were found in plugins and 9% in themes. Only six were in the WordPress core itself.
That split matters, because it tells you where the risk actually sits. It isn't the platform. It's the eleven bits and pieces bolted onto it, each one quietly ageing.
Problems arrive faster than most people expect
There's a comforting assumption that if something serious turned up you'd have weeks to deal with it. You don't.
Patchstack measured the gap between a flaw being made public and attackers actively exploiting it. For the vulnerabilities that get hit hardest, the median was five hours. Roughly half of high-impact flaws were being exploited within a day. And in 46% of cases, the flaw was made public before the plugin's developer had even released a fix.
None of this is targeted at you personally. It's automated — scripts crawling the web looking for any site running a version they know how to get into. A café in Brunswick and a listed company look identical to a scanner.
Two other findings are worth knowing. First, when Patchstack tested how well typical hosting security setups blocked these attacks, only 26% were stopped — so "our host handles security" covers less than most owners assume. Second, of the ten most-attacked vulnerabilities in 2025, only four were new. The rest were older flaws that attackers keep hammering because so many sites are still sitting on out-of-date versions, years later.
A compromised site rarely looks compromised
The mental image most people have of a hacked website — a black screen, a skull, a ransom note — is now the rare case. It's bad for business if you're a criminal: the owner notices immediately and fixes it.
Modern website malware is built to stay hidden. The most common families use a technique called cloaking: they check who's asking for the page and serve different content accordingly. Google's crawler gets keyword-stuffed spam. A visitor from a search result gets bounced to a dodgy store or a phishing page. You, logged in from your own laptop, see your site exactly as it always looked.
So the symptoms show up sideways. Enquiries taper off. Your rankings slide for no obvious reason. A customer emails to say something strange happened when they clicked your listing. Some infections even burrow into legitimate files or sit resident in server memory, rewriting themselves after a clean-up — which is why a compromised site can appear fixed and then quietly reinfect a few days later.
There's also a timing pattern worth flagging for anyone with a retail or hospitality business. Malicious file uploads observed across global hosting infrastructure nearly tripled in November and December — peak trading, minimum staffing, slowest response times.
What it costs, and what it costs to avoid
The Australian Signals Directorate's Annual Cyber Threat Report for 2024–25 puts the average self-reported cost of a cybercrime incident for a small business at $56,600, up 14% on the previous year. ASD received more than 84,700 cybercrime reports over the year — roughly one every six minutes.
Not every incident is a hacked website, and not every hacked website costs that much. But the figure is a useful counterweight when a maintenance plan looks like an expense you could skip. The clean-up, the lost enquiries during downtime, the weeks of rebuilding search rankings after a spam infection, and the awkward emails to customers all add up quickly.
What good care actually covers
Maintenance isn't glamorous and it shouldn't be mysterious. A reasonable plan for a small business site covers:
- Regular updates to the platform, theme and plugins — applied on a schedule, and checked afterwards to make sure nothing broke.
- Off-site backups taken automatically, kept for a sensible period, and — the part people forget — actually tested by restoring one.
- Uptime monitoring so somebody knows the site is down before a customer tells you.
- A working SSL certificate, renewed before it expires rather than after your browser starts warning visitors away.
- Fewer plugins. Every add-on is another moving part. Removing three you no longer use is real security work, not housekeeping.
- A named person to call when something goes wrong, who already has the logins and knows how your site is put together.
Two extras are worth asking about: whether anyone is watching for vulnerabilities specifically, rather than relying on the host's general firewall, and whether your PHP version is still supported. An unsupported PHP version stops getting security fixes entirely, and it's one of the most common things we find on sites that haven't been touched in a few years.
If you've got a plan already, it's worth reading what's actually in it. "Hosting" and "hosting and support" are very different products at similar-looking prices, and the difference only becomes obvious on the day you need it.
If you can't remember the last time your website was updated, or you're not certain whether anyone is backing it up, that's worth ten minutes of somebody's attention — not because it's urgent today, but because these things are cheap to prevent and expensive to fix.
We're happy to take a look and tell you plainly what's there and what isn't, whether or not you end up working with us. Get in touch and we'll go through it with you.
