5 Website Security Mistakes That Are Putting Your Business at Risk

South Africa is one of the most targeted countries for cybercrime on the continent. Kaspersky's 2025 report recorded over 230 million cyberattack attempts in SA in a single quarter. Small businesses get hit disproportionately hard because hackers know they usually have weaker defences than large corporations, yet they still hold valuable data and often process payments.

Most attacks aren't manual. They're automated, run by bots that crawl the internet around the clock looking for websites with known weaknesses. If your site has one, it will eventually be found and exploited, often without you knowing until the damage is already done.

Below are the 5 security mistakes we see on South African business websites again and again, along with exactly how to fix each one.

Why SA Small Businesses Are Targeted

Small businesses make attractive targets for a few reasons:

• They hold customer data (names, email addresses, phone numbers, payment info) that can be sold or used for further attacks
• They often run outdated software with known vulnerabilities
• They rarely have dedicated IT security staff
• A compromised website can be used to send spam, host malware, or attack other systems
• Ransomware works well against businesses that can't afford to lose their data but also can't afford professional recovery, which makes them especially profitable to target

Under POPIA (the Protection of Personal Information Act), South African businesses are also legally required to protect customer data. A breach can mean regulatory fines of up to R10 million, plus reputational damage that's hard to undo.

Mistake 1: No SSL Certificate (Not Using HTTPS)

If your website address starts with http:// instead of https://, your site isn't encrypted. That means any data passing between your visitor's browser and your server, including contact form submissions, login details, and payment information, travels in plain text and can be intercepted.

The Consequences

• Browsers like Chrome show a "Not Secure" warning in the address bar, which sends visitors running
• Google uses HTTPS as a ranking signal, so HTTP sites get penalised in search results
• Customer data submitted through your forms is open to interception
• You're almost certainly falling foul of POPIA's data protection requirements

The Fix

SSL certificates are free these days. Let's Encrypt provides free SSL certificates that most hosting providers can install automatically. Contact your host and ask them to set up a free Let's Encrypt certificate. It should take under 5 minutes and cost nothing.

Once it's installed, make sure all traffic redirects from HTTP to HTTPS with a 301 redirect. Check with SSL Labs (free) to confirm your certificate is set up properly.

Mistake 2: Outdated Software and Plugins

If you run WordPress, which powers roughly 43% of all websites globally, every plugin and theme you install is a potential security hole. Researchers and hackers alike are constantly finding flaws in popular plugins. Developers release patches, but only sites that actually update get protected.

The Scale of the Problem

The Wordfence security team reports that over 90% of WordPress hacks happen through known, already-patched vulnerabilities. In other words, most hacked sites were running software with a security update sitting right there. The owner just hadn't applied it yet.

The Fix

• Enable automatic updates for WordPress core, plugins, and themes wherever possible
• Check for and apply updates at least once a week if automatic updates are off
• Delete plugins you don't use. Inactive plugins are still a security risk if they're carrying vulnerabilities
• Only install plugins from reputable sources with recent update histories and solid install counts
• Remove nulled (pirated) themes and plugins straight away. They often contain backdoors

Mistake 3: Weak Passwords and No Two-Factor Authentication

Brute force attacks, where automated tools try thousands of username and password combinations per second, are one of the most common ways WordPress sites get broken into. The default admin URL (/wp-admin) is known to every attacker out there.

The Fix

• Use strong, unique passwords. A strong password runs at least 16 characters and mixes uppercase, lowercase, numbers, and symbols. A password manager (Bitwarden is free and works well) can generate and store these for you.
• Change the default admin username. Never use "admin" as your WordPress username. It's the first thing brute force tools try.
• Enable Two-Factor Authentication (2FA). Install a plugin like WP 2FA (free) to require a time-based code from your phone at login. This makes brute force attacks practically impossible.
• Limit login attempts. Use a plugin to block IP addresses after 3 to 5 failed login attempts.
• Change the login URL. Use a plugin to change /wp-admin to a custom path like /my-login-2026. This wipes out the majority of automated attacks, since they target the default URL.

Mistake 4: No Website Backups

Backups aren't a security measure against being hacked. They're a recovery measure. When something goes wrong, not if, whether that's a hack, a failed update, or an accidental deletion, a recent backup is the difference between a 30-minute fix and rebuilding the whole site from scratch.

What Many SA Business Owners Assume

Plenty of business owners assume their hosting provider keeps backups for them. Some do, some don't, and the ones that do often keep just 7 days' worth at extra cost. Don't rely solely on your host for this.

The Fix

• Automated daily backups: Use a plugin like UpdraftPlus (free tier available) to back up your WordPress database and files automatically, every day.
• Offsite storage: Store backups somewhere separate, like Google Drive, Dropbox, or Amazon S3. Don't keep backups only on the same server as your website.
• Test your backups: A backup you've never tested might not restore properly. Run a test restoration at least once every 3 months.
• Keep 30 days of backups: Some hacks aren't discovered right away. You might need to restore a backup from 2 weeks ago to get a clean version back.

Mistake 5: No Web Application Firewall (WAF)

A Web Application Firewall sits between your website and incoming traffic, checking requests and blocking the malicious ones before they reach your site. It protects against SQL injection, cross-site scripting (XSS), brute force attacks, malware uploads, and dozens of other attack types.

The Fix

• Cloudflare (free tier): Cloudflare's free plan includes a basic WAF and DDoS protection. Setting it up on your domain takes 15 to 20 minutes and costs nothing. It's the easiest and most effective single security upgrade for most SA business sites.
• Wordfence (WordPress): The free version of Wordfence includes a firewall, malware scanner, and real-time threat intelligence. Install and configure it on every WordPress site you manage.
• Sucuri (all sites): Sucuri's free scanner checks whether your site is blacklisted or infected. Their paid WAF service is worth it for e-commerce sites handling payment data.

Signs Your Website Has Already Been Hacked

Most attacks are silent, so plenty of sites stay compromised for weeks before the owner notices. Watch for:

• Google Search Console showing security warnings or manual actions
• Your website redirecting visitors to spam or adult sites
• New admin user accounts you didn't create
• Google search results for your site showing strange content you didn't write
• Your hosting provider suspending your account for sending spam or hosting malware
• Antivirus software flagging your website when you visit it
• A sudden, sharp drop in organic search traffic

If you suspect your site has been compromised, contact your host immediately, change every password, and consider hiring a professional to clean it up.

Check Your Security Right Now

Use these free tools to audit your website's security today:

• Sucuri SiteCheck: Scans for malware, blacklisting, and basic security issues
• SSL Labs: Tests your HTTPS certificate setup
• Google Search Console: Google alerts you here if it detects security issues on your site
• Have I Been Pwned: Check whether your email address has turned up in known data breaches

At Smart Web Design, every website we build is secured from day one: SSL, security headers, WAF, and hardened WordPress configuration come as standard. If you're worried about your current site's security, contact us for a free security assessment.