Your old website isn't just dated. It's a target.

Most small-business websites were built once, paid for once, and then left alone. The site still loads, the phone number is right, so it feels fine. Here is the problem with "it still loads": attackers are not judging your website by how it looks. They are judging it by what it runs, and an old site runs old software.

Nobody is choosing your website. That is the point.

The most common misconception we hear from owners is some version of "why would anyone hack us?" It is the wrong question, because almost nobody gets chosen.

Automated scanners probe every website on the internet, around the clock, looking for known holes: an outdated plugin here, an old PHP version there, an admin page with a guessable password. When a scanner finds a match, the break-in is automatic too. Your site does not get hacked because someone picked your business. It gets hacked because a bot matched it against a list.

That is actually good news, because it means the defense is not exotic. You do not need to outsmart a determined attacker. You need to not be on the list of easy matches.

Two numbers that explain the whole problem

About 43 percent of all websites run WordPress, and its plugin ecosystem is the single most common way small-business sites get compromised. And roughly three in four websites run on PHP, the language underneath WordPress and much of the rest of the web. Old, unpatched PHP is a standing invitation.

Put those together: the typical small-business site is a stack of software that other people wrote, and every layer of it ages. A website is not a brochure you print once. It is a running system, and running systems need maintenance or they drift toward trouble.

October 2026 made the point for us

If that sounds theoretical, one month of recent headlines says otherwise:

• Critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell) were disclosed on October 21. The NSA publicly advised organizations using PHP to apply the fixes immediately, and to take systems offline until they could. Major platforms including Wikimedia and Archive.org briefly went dark to patch.
• A WordPress backdoor campaign: researchers report attackers used stolen plugin-dashboard keys to install backdoors on live business sites over an 18-hour stretch.
• A maximum-severity GitLab flaw, scored 10 out of 10, was patched on October 12, with a public proof of concept and active probing reported within days.

We wrote plain-English briefings on all three in our security hub. The pattern across them is the one that matters here: maintained systems shrugged these off. Sites and servers that nobody maintains are the ones that stay exposed for months, because the fix exists and nobody applies it.

What an outdated site actually risks

• Silent backdoors. A compromised site often keeps working normally while serving malware to your visitors or hosting phishing pages under your name.
• The Google label. Search results can flag your site with a hacked-site warning. Traffic falls off a cliff until it is cleaned and re-reviewed.
• Stolen form data. Whatever customers type into your contact or booking forms can be skimmed, and the fallout is yours to handle.
• Spam under your brand. Injected pages and links quietly ruin your search rankings and reputation.
• The emergency rebuild. Cleaning up a compromise under pressure costs far more than the upkeep that would have prevented it, and it happens on the attacker's schedule, not yours.

Warning signs you can check in five minutes

• You cannot remember the last update, or who would even do one.
• The site was built more than two or three years ago and untouched since.
• No padlock in the address bar, or the browser says "not secure".
• The person who built it is long gone.
• It looks broken on a phone.
• The contact form goes nowhere, or you are not sure it works.

Two or more of those, and your site is overdue for a real look. Not because disaster is guaranteed, but because every one of those signs tells the scanners the same thing: nobody is watching this one.

Two ways this goes

Ignore it, and the likely ending is finding out from a customer: the site is defaced, blacklisted, or quietly serving something it should not. Cleanup at that point is urgent, public, and expensive.

Or maintain it: core, plugins, and PHP brought current, leftovers swept out, backups verified, https enforced, and then someone keeps watching so it never becomes an emergency. Old websites do not get targeted because they are old. They get targeted because old usually means unmaintained. Change that one fact, and you fall off the list.