Your website could be the opportunity a cyber criminal is looking for

Your business does not need to be well known for its website to attract the wrong attention. An outdated plugin, forgotten administrator account or exposed backup can create an opportunity.

A customer visits your website to find a product, request a quotation or check whether your business looks trustworthy.

An attacker may visit for a different reason.

They want to know what software you use, whether it has a known weakness and whether anything valuable has been left accessible.

For a South African business that depends on online enquiries or WooCommerce sales, that opportunity can become a costly interruption.

Our cyber security partner, J2MSSP, explores this issue in its article, “You Don't Have to Be Famous to Be Vulnerable.” The same principle applies to your website: being a smaller business does not remove the need to protect it.

An outdated website can leave a door open

WordPress, Joomla, plugins, extensions and templates all need ongoing maintenance.

When a security update becomes available, leaving vulnerable software in place can give attackers a weakness to exploit. A website can still look good and function normally while that weakness remains.

Updates also need care. Applying an update without checking compatibility can affect checkout, contact forms or other important functions.

A useful maintenance process includes:

• Identifying software that needs attention.

• Prioritising known security vulnerabilities.

• Keeping a current backup before making changes.

• Applying updates and checking important website functions.

• Removing unused or unsupported components.

At Cartmell & Cartmell Communications, ongoing website maintenance forms part of our website maintenance and retainer services.

The aim is to keep your website supported and working, while reducing avoidable exposure.

Old accounts can become new problems

Who can log into your website today?

The answer may include your current team, a previous developer, a former employee and an agency that completed a project several years ago.

Access often accumulates because nobody has been asked to review it.

Shared administrator accounts make this harder. If several people use one login, identifying who made a change becomes more difficult. Removing one person's access may mean changing the password for everyone.

Give people individual accounts wherever possible. Use permissions that match their work, enable multi-factor authentication where supported and remove access when it is no longer needed.

Someone who edits a blog post does not automatically need control over plugins, users and website settings.

Your hosting account needs attention too

Protecting your website also means protecting the services around it.

Hosting access, domain registration, DNS records and backup storage can all affect your online presence.

For example, unauthorised DNS changes could redirect visitors or interfere with email delivery. A compromised hosting account could expose website files and databases.

Our website hosting services support the foundation your website runs on. That foundation works best alongside regular maintenance, controlled access and a clear backup strategy.

A security plugin alone cannot take responsibility for all these areas.

A backup is only useful if it supports recovery

Imagine your online shop is compromised on a Friday afternoon.

You need to know which backup is clean, who can restore it and how much recent data could be lost.

Restoring an older copy of a WooCommerce database may remove orders or customer changes made since that backup. Restoring infected files may put the problem straight back.

A recovery plan should account for:

• Backup frequency and retention.

• Copies stored separately from the live website.

• Access to those copies during an incident.

• A practical way to check that restoration works.

• Recent orders, enquiries and other changing data.

• Fixing the original weakness before returning to normal operation.

Backups help you recover. They need to sit alongside prevention and investigation.

Website security and email security need to work together

Your website may collect enquiries, send order notifications and connect with external services.

Your employees then use email and business systems to respond, share documents and process payments.

These connections matter. A well maintained website cannot stop every phishing email, and email protection cannot patch an outdated website extension.

Cartmell focuses on website management, hosting, maintenance and your public digital presence. Our partner J2MSSPprovides managed cyber security across users, email, data, machines and internet access.

For businesses concerned about phishing, impersonation and email threats, explore J2MSSP’s email security services.

The responsibilities should be clear, with the right specialists looking after each area.

Start by asking who owns the responsibility

Before buying another product, ask:

• Who keeps our website software updated?

• Who reviews administrator and supplier access?

• Who controls our domain, DNS and hosting accounts?

• Who checks our backups and handles recovery?

• Who investigates suspicious activity in our business email?

If the answers are unclear, start there.

Our Webmaster Service provides ongoing oversight of your website and connected digital assets, helping coordinate maintenance, hosting, security, backups and technical suppliers.

Your business does not have to be famous to be vulnerable. It needs someone taking responsibility for the opportunities an attacker might find.

Speak to Cartmell & Cartmell Communications about your website, hosting and maintenance requirements. Where you need wider business cyber security or email protection, we can help you connect with J2MSSP.