It started with a staff member searching for their own business to send a customer the link. Instead of the homepage, they got a full-page red warning: deceptive site ahead. Then the phone calls started. Customers had seen the same thing, and some had been sent somewhere that was not the business at all.
It was a WordPress site, built years earlier with no real security, launched, and forgotten. It kept loading every day, so everyone assumed it was fine. Somewhere along the way, someone tried the door, found it open, and let themselves in.
Here is what surprises people. Whoever breaks in almost never comes to wreck the place. A working site is worth more to them running, so they keep it running and make it quietly theirs. They leave a hidden way back in, called a backdoor, and put the site to work: spam, redirects, malware for the next visitor. Sucuri, a website security company, reported finding at least one backdoor on 49% of the hacked sites it cleaned in 2023. Google tracks this too. A Google and UC Berkeley study followed 760,935 site hijackings in a single year. Google’s own help pages describe the warning that visitors see on one.
By the time it reached me, the site was too far gone to clean. Once strangers have left themselves that many ways back in, you cannot trust that you found the last one. So I did not try. I deleted the whole site, down to the ground. Then I had the hosting company scan everything else on the account, because an infection like this rarely stays in the one folder where you find it.
Two lucky breaks made the rebuild possible. There was an old copy of the site’s database kept off the server, where the infection never reached it. The database is where WordPress keeps every page and post. And the site had not changed in years, so that stale copy was still current. The services, the hours, the team bios and the pages people actually read were all in it. I pulled that content out and started clean.
This time I built it to last. A custom WordPress theme, the layer that controls how the site looks, made for them instead of one pulled off a shelf. Real photography of the actual team and the space, in place of stock images of strangers. And real security, which is careful work, not a switch you flip. That meant a hardened setup with every unneeded door closed, strong passwords, fresh encryption keys, and SSL, the padlock and https in the address bar. Login and author details were closed off so bots cannot harvest them. What they got back was a site that looked like them and would not fall over the first time someone rattled the handle.
Doing security right the first time costs a fraction of a cleanup and rebuild, before you count the days customers are turned away by a red warning. A website with no security is not saving money. It is putting off a bill that comes due on the worst possible day.
Three questions tell you where your own site stands. Do you know who set it up, whether anyone has updated it this year, and whether a backup lives somewhere other than the server? If any answer is “I don’t know”, that is your answer.
My free website audit answers part of the second question in a single scan. It checks a WordPress site’s version, plugins and theme against known security holes. Finding out the rest takes an afternoon. Finding out from a customer takes a lot more than that.