It's Cybersecurity Awareness Month — Is Your Website Actually Protected?

October is Cybersecurity Awareness Month — mostly aimed, at least in the marketing around it, at big IT departments running annual phishing-training videos. But a small business website is just as much of a target, often more so, because nobody's specifically watching it. Here's what actually matters, in plain terms.

Small sites get hit by automation, not hackers

Nobody is personally choosing to attack a small local business's website. What actually happens is automated scanning — bots crawling the internet looking for outdated software, default passwords, and known vulnerabilities, then exploiting whatever they find without a human ever looking at the site first. That's why "we're too small to be a target" is backwards: smaller, unmaintained sites are exactly what automated attacks are built to find.

What a secure small business site actually requires

• HTTPS/SSL on every page, not just the contact form — browsers now flag non-HTTPS sites directly to visitors
• The underlying software — CMS, plugins, and server-level components like PHP — kept current, not just installed once at launch
• Real backups that are actually tested, not just scheduled and assumed to be working
• Unique admin credentials with two-factor authentication, not a password reused from somewhere else
• Limited access — the fewer people with admin logins to a site, the fewer ways in

Why this isn't a "set it up once" task

Security isn't a setting you configure at launch and leave. New vulnerabilities get discovered in common software constantly — including, as of this week, a critical flaw in PHP itself, the language that runs a huge share of the web. A site that was secure at launch and hasn't been touched since is, by definition, no longer current with what's been found since.

What's actually included in our hosting

This is the specific reason our managed hosting plans bundle SSL, security monitoring, and patching into every tier instead of selling it as an add-on: website security is ongoing maintenance work, not a one-time checkbox, and treating it as anything else is how sites quietly become one of the unmaintained ones automated attacks are built to find.

• Read the full PHP2Shell writeup — how it happened, who got hit, what to do
• Managed Hosting — SSL, security, and patching included
• Talk to us about securing your current site

QIs my small business website actually a target for hackers?

Yes — just not personally. Most attacks on small sites are automated scans looking for outdated software or weak credentials, not a human specifically choosing your business. Being small doesn't make a site invisible to that kind of scan.

QWhat's the single most common way small business sites get compromised?

Outdated software — an old CMS version, an unpatched plugin, or an unpatched server-level component like PHP — left unmaintained after launch. Automated attacks are built specifically to find exactly that.

QDoes Kore Web Dynamics handle security patching for hosted sites?

Yes. SSL, security monitoring, and patching are included in every managed hosting tier we offer, not sold separately — it's treated as part of hosting a site responsibly, not an optional upgrade.