PART 1 OF 2 | Website Security for Small Businesses
Let's get something straight. If your business depends on a website, this conversation is for you.
For years, we heard the warnings. AI would make hacking easier. Cyberattacks would become faster, cheaper, and harder to stop. People called it doomsday talk. A little dramatic, maybe. Something we'd deal with later.
Well, it's later.
In August 2026, a cybercriminal used hundreds of AI agents to target organizations running PaperCut, a software businesses and schools use to manage printing. GreyNoise identified 395 affected organizations across 48 countries.
At one American high school, the attacker went from breaking in to taking control of the school's network in just seven minutes.
Seven minutes.
Then, on October 21, 2026, two critical PHP vulnerabilities made headlines. PHP powers close to 70% of websites whose server-side programming language can be identified. The vulnerabilities could allow attackers to run malicious code on affected systems without logging in.
The PHP team released security updates, and the Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch affected systems.
Here's the catch: AI can help find security holes, but attackers can use it to exploit them, too.
The website apocalypse isn't that every website has already been hacked. It's that finding weaknesses is getting easier, attacks can move faster, and too many businesses are still operating like none of this concerns them.
And that other 30%? Don't mistake a statistic for a security guarantee. No percentage tells you if your website is safe.
Let's talk about what this means to your business.
Your Website Is Not Just a Website
Think about what your website connects to: your business email, customer information, booking system, payment processor, and domain registrar.
If someone gains unauthorized access, they can redirect visitors to a malicious page, change payment instructions, steal personal and financial information, or disrupt your operations. If you collect information about children, families, students, or clients, the consequences can extend beyond your business.
A website compromise doesn't automatically mean your bank account has been emptied. But it can create opportunities for fraud, identity theft, and further attacks.
Protecting your website is part of protecting your business. And that brings us to a problem many small business owners face. Not knowing where you are exposed.
Building a Website Is One Thing. Maintaining It Is Another.
Running a small business is already a full-time job. You're managing customers, payroll, inventory, staff, and everything else that keeps the doors open.
Website maintenance? That can easily fall to the bottom of the list.
Until something breaks.
Websites need ongoing attention. Software needs updates. Security weaknesses need patches. Backups need to be checked. User access needs to be reviewed.
But most small businesses don't have a dedicated IT department handling those tasks.
That doesn't mean you're careless. It means you're running a business.
Your website platform determines how much of this work you need to manage yourself.
With WordPress, someone needs to keep WordPress, its plugins, and its themes updated. Depending on your hosting arrangement, you may also need someone to manage server-level updates and backups. Your hosting provider might handle some of that work, but don't assume it handles everything.
With Squarespace, Wix, or another hosted website builder, the provider manages much of the underlying infrastructure. You generally don't need to install server-level security patches yourself. But account security, administrator access, connected applications, and website settings still need attention.
With managed hosting, your provider may handle server updates, backups, and other maintenance. What's included depends on your plan and service agreement.
No platform eliminates every security risk. The question is: Who is responsible for what?
If you manage your website yourself, understand what that involves. If a freelancer built it, find out if an ongoing maintenance is included. If your hosting provider manages the technical side, ask what it covers and what still falls to you.
You don't need to become a cybersecurity expert. You need clear responsibilities and someone qualified to help when the work goes beyond your expertise.
Don’t leave your website security up in the air.
Help Is Available Through Hennepin County
If your business is in Hennepin County, Minnesota, you may be eligible for IT consulting and cybersecurity support through Elevate Hennepin at no cost.
Technologist Computers is an Elevate Hennepin technology advisor. Eligible businesses can access consulting services subject to program requirements and the scope of the work.
You run the business. We'll help you make sense of the technology.
Next Week: What Should You Do?
Knowing your website needs maintenance is one thing. Knowing what to check, what to update, and who should do the work is another.
Next week, Part 2 gets practical. We'll explain what to review based on your website platform, how to secure your accounts, why backups matter, and what to do if something looks wrong.
Subscribe to our newsletter to get our upcoming Small Business Website Security Checklist, a practical four-page guide to website maintenance, updates, account security, and backups.
Don't panic. Don't guess. Start asking the right questions.
Your website is part of your business. It's time to treat it that way.
Your website shouldn’t be the weak link in your business.
