Most business owners consider website security the same way they consider locking the front door at night: by setting a password, perhaps getting an SSL certificate, and then assuming that everything is OK since nothing seems to be wrong.
The problem is that the most harmful website attacks are those which go unnoticed. A site that has been hacked usually appears totally normal from the outside. Your homepage will load, and your contact form will function, so your customers will notice nothing at all. Yet in the background, someone might be using your site to send out spam, redirecting your visitors to fraudulent pages, taking over your search rankings, or stealing sensitive information that your visitors confide in you, such as passwords, credit card details, or protected health and personal data.
Recently, we assisted in cleaning a website that had been compromised, and this experience clearly showed just how stealthy today’s attacks have become. We would like to explain what we found, using simple language, since the first thing you need to do to protect your business is to understand the risk.
A Hacked Site Rarely Looks Hacked
The image that most people have of a hacked website is of a homepage that has been defaced with a skull and crossbones. However, that kind of thing almost never occurs anymore.
Attackers nowadays want to remain hidden for as long as possible since the longer they’re not noticed, the more they’ll be able to carry out. On the site we were working on, the attackers had:
- Created a fake administrator account that was deliberately hidden from the user list
- Installed malicious tools disguised as trusted, legitimate plugins
- Set up a redirect to send some visitors to pages the attacker controlled
- Quietly claimed the site in Google’s tools so they could manipulate how it appeared in search results.
If you just logged in and browsed around, all of this would not be visible. It is this point that astonishes people the most.
Why Checking the Admin Screen Is Not Enough
It’s often thought that if you log into your website and everything appears to be normal, then you’re safe. Unfortunately, this is precisely what attackers are expecting.
The malicious software that we discovered was, in fact, designed to hide itself. One instance deleted itself from the list of installed plugins so that an administrator looking through the list would never notice it. Another one concealed the attacker’s secret administrator account from the list of users. It also forged its own date of creation in order to make it appear older and less suspicious.
That is to say, the dashboard you use to monitor your site may be the very thing the attacker alters to prevent you from detecting them. The only certain way to know what is actually going on is to investigate the files and database underlying the site more closely, since the truth cannot be concealed there.
Carrying out that type of review requires time, the appropriate tools, and a person who knows what a backdoor really looks like. Most business owners won’t be able to carry it out by themselves, and the website itself will never warn you about it.
It Can Happen to a Well-Maintained Site
It is worth explaining a common misconception at this point. The idea is that websites that have been hacked are those that are neglected, i.e., sites that no one has looked after for years. This is often the case, but not always.
The site we assisted in recovering was, in fact, being kept in a responsible manner. Its plugins were updated regularly. The software used was a genuine and widely popular plugin from a reliable source, that is, the kind of plugin installed on millions of websites. The way it was being operated was by no means reckless.
The situation was that a vulnerability was found in that plugin, and for a short period of time, until the patch had been released and installed, the door was open. Attackers act quickly. They use automated tools to continuously scan a large number of websites for newly discovered vulnerabilities, usually within hours, and they managed to get in during that short time interval between the flaw appearing and the update arriving.
The window is getting smaller. Because of the development of powerful AI tools, attackers can now detect vulnerabilities and create working exploits more quickly than ever, occasionally carrying out these tasks in just a fraction of the time it used to take. The same technology that helps companies become more productive is also helping attackers work more efficiently, so the time between a vulnerability becoming known and being actively exploited is now shorter than at any previous time.
That is the unpleasant truth: even if you do all the right things, your risk is greatly reduced, it won’t be eliminated altogether. And that is precisely the reason why the situation that follows a break-in is so serious.
Patching the Plugin Does Not Remove the Attacker
This is the part that throws people off.
As soon as you realize that an outdated plugin has allowed access, the obvious thing to do is to update it right away. That is the correct course of action, but it’s necessary to realize what the update actually achieves. It fills the first gap, thereby preventing new attackers from exploiting that weakness.
It offers almost no measures against the attacker who has already gained access.
Here’s a way of looking at it: the weakness was the method the burglar used to pick your lock. However, after they had got in, they didn’t continue to pick the lock; instead, they opened a few windows, made copies of your keys, and left the back door open for future attempts. It’s a good idea to replace the first lock, but that doesn’t cure any of the other problems. The burglar no longer needs the original method because they have their own now.
That’s the reason why simply applying patches after an attack has already taken place leads to a false sense of security; the site appears to have been fixed, and the vulnerability is no longer there. Yet the individual who carried out the attack probably still has complete access via the hidden entrances that they established while inside.
Deleting a Bad Plugin Does Not Fix the Problem Either
The same reasoning holds when removing malicious plugins, and this is one of the most important yet least understood aspects of handling a hacked site.
That doesn’t mean that deleting a malicious plugin has really solved the problem. Attackers almost never use just one method to get back in; instead, they set up a number of hidden entrances so that if one is found and removed, the rest remain.
There had in fact been two entirely separate waves of malware placed on the site at different times, and the first cleanup operation eliminated one of these waves but completely overlooked the other. If we had stopped there and taken it for granted that the job was finished, the attacker would have simply got back in.
Proper recovery from an attack involves more than just getting rid of the obvious issue. It means:
- Finding and removing all hidden doors, not just the first one
- Changing the secret keys and passwords the attacker may have stolen
- Resetting access for everyone who can log in, including at the hosting level
- Removing old accounts that no longer belong to anyone
- Re-scanning everything afterward to confirm the site is truly clean
If you omit any of these steps, the door will remain cracked open, which is why a quick fix is rarely a real fix.
Staying Updated Is Not Optional
A large number of website attacks are successful since something was out of date; legacy software has always had weaknesses, and attackers actively search the internet for sites that have not applied patches.
One of the simplest and most effective things you can do is to keep the core software, the plugins, and the themes of your website up to date. As we looked at earlier, it will not make you entirely immune, since weaknesses can still be exploited during the short period before a fix is available. Nevertheless, it shuts the door on the vast majority of attacks, all of which target already known problems that have already been patched. The problem here is that the updates have to be carried out consistently and carefully. An update that causes your site to break is a problem in its own right, which is why regular maintenance carried out with monitoring is better than occasionally remembering to click the update button.
It’s similar to the oil in your car; missing one probably won’t do any harm, but if you skip it for two years you’ll eventually end up with a dead engine.
Every Plugin Is a Door Into Your Site
This is the aspect that business owners would benefit from understanding before they are hacked.
The code for every plugin that you install was written by someone else and is running on your website, with access to both your site and your visitors’ information. In most cases, a well-designed and well-maintained plugin is acceptable. However, each additional plugin introduces another possible vulnerability, another item that might become outdated, and another company with which you are placing your business at risk.
You easily end up with twenty or thirty plugins since each of them had at one time solved a specific problem. The result is a website put together from dozens of different pieces taken from dozens of various sources, any one of which could be the means by which an attacker gets in.
One of the main benefits of having a custom-built site is that a small amount of custom-written code can usually replace many plugins. Rather than depending on a third party to provide a simple feature, the relevant functionality is on your own site, under your control, and exposes nothing extra to the outside world. Since there are fewer components involved, there are fewer things that can go wrong or be exploited.
The point is simple: when installing things, be selective. Use only plugins that you really need, obtain them from reliable sources, and get rid of those that you don’t. Each plugin you can avoid means one less risk.
Security Is Ongoing, Not One and Done
The most important lesson from all of this is that website security can’t be turned on once and then forgotten; it has to be something you continuously carry out.
You need to keep an eye on sites. Files and databases should be regularly checked for anything suspicious, since the signs that a system has been compromised usually show up there long before any actual damage becomes visible. Software should remain up to date. Access must be managed as staff members join and leave, and when a problem does occur, it must be dealt with thoroughly, not just patched over.
It’s a lot to keep an eye on while also managing your real business. The good thing is that you don’t have to handle it by yourself.
How Rocket Cat Can Help
We have two methods for taking this off your plate.
If you want lasting peace of mind, our monthly maintenance plans will keep your site up to date, monitored, and regularly checked for suspicious activity so problems can be detected early rather than after the damage is done.
If you’re unsure about your site’s current position, our single full security scan will go beneath the surface to check your files and database, detect any hidden problems, and provide a clear view of your site’s condition, along with our recommendations.
Either way, you get the reassurance of knowing that someone who understands these threats is actually looking, instead of hoping that everything is fine because nothing looks wrong. And as attackers grow faster and more capable, having someone keeping watch matters more than it ever has.
If you would like to talk through which option makes sense for your business, get in touch. We are always happy to help.
