How do websites get hacked?
Most attacks are not aimed at a particular company, but at a known vulnerability. If you know the ways in, you can close most of them.
- Ways inWhich ways in are used almost every time
- Warning signsHow to spot an attack before your customers do
- Emergency planHow an emergency is handled and which prevention works
How a known vulnerability turns into an attack
Two websites with the same vulnerability. Only one of them gets the update from June 2.
- Update released, flaw described
- Update installed
- Scan finds no old version
- Update released, flaw described
- Update left waiting
- Scan finds the old version
- Malware planted
- Unknown admin, hidden spam pages
- Browser warning, a customer asks
Brute force on passwords
Using lists from other sites' data leaks. A password that is also used elsewhere falls first.
Access details in old emails
They sit for years with both sender and recipient. Whoever opens either mailbox has the website.
Pirated and deactivated plugins
Pirated premium versions often come with malware. Deactivated plugins remain open to attack.
How to recognize an attack
An attack is usually meant to go unnoticed. Still, it shows in these four places.
A red warning in the browser before your website appears
Strange terms or languages in search results for your company
An admin user that nobody created
Unknown links or redirects to someone else's offers
Three cases from practice where access became the problem
Sent in plain text for years.
Since then: one-time links only.
Active for months after a change of provider.
Since then: a checklist, review after 30 days.
Login protection blocks after failed attempts.
Most common support case: quickly solved.
Handling an emergency
If the site is only cleaned and the way in stays open, the malware comes back. That is why there is a fixed order.
The cycle starts over.
The incident is closed.
- 1Isolate
- 2Back up current state
- 3Scan
- 4Change passwords
- 5Clean
- 6Close the way in
How we protect websites against attacks
Updates, good passwords and a protected login area prevent most incidents. Every way in has a fixed countermeasure.
- Outdated plugin Security updates first, tested on staging
- Deactivated plugin Delete unused plugins, not just deactivate
- Weak password Strong passwords, limited attempts, two‑factor where suitable
- Access details in emails Shared only by one-time link or through the customer area
- Malware from unknown sources Regular malware scans
- Forgotten access Remove old access at handover
- Website outage 24‑hour uptime monitoring