hello@kootenaymade.ca
Castlegar, BC. Serving the Kootenays and beyond.
6 min read
Key takeaways
- Most attacks on small sites are automated. They try known holes on every site they can reach.
- Fewer ways in means fewer things that need a fix when the next flaw is found.
- On the sites I build, the hosting platform patches its servers and I update the framework.
- React2Shell hit the framework I build on in December 2025. Fixed releases shipped the same day.
- Your email, passwords, registrar and Google account stay in your hands, whatever the site runs on.
On this page
What does small business website security come down to?
For most small businesses, it comes down to two things. How many ways into the site there are, and who applies the fix when a flaw is found. Attacks on small sites are mostly automated, and they try known holes on every site they can reach.
Being small does not take a business off that list. A scanner has no idea whether it found a bakery or a bank. So the useful questions are about the site itself. What is running on the server, and whose job is it to keep that up to date?
Why is the risk smaller on the sites I build?
Because there is less on the server to attack, and the patching has an owner. A brochure site I build is pages made ahead of time. Here is what that changes.
- 01
Pages built ahead of time
A brochure site I build is pages made ahead of time and served as finished files. The server holds no database and no admin login to break into.
- 02
No plugins
Every feature is written into the site’s own code. Nothing on it depends on a plugin from another developer that needs its own updates.
- 03
Patching has an owner
The hosting platform patches its servers, and I update the framework the site is built on. You do not have to watch the news for alerts.
- 04
Locked-down browser settings
Every site ships with a Content Security Policy, HSTS and locked-down browser settings. My trust and security page lists each one and shows how to check them yourself.
Why do plugins matter so much?
Each plugin is code from another developer, and each one needs its own updates. October 2026 brought two reminders on WordPress alone.
Attackers used a flaw in the Bricksforge plugin (CVE-2026-85097) from October 7 to upload and run their own code. It was fixed in version 3.1.8.10. Patchstack also reported that stolen UpdraftCentral dashboard keys were being used to plant backdoors on connected WordPress sites.
Plenty of WordPress sites are well looked after, and both problems had a fix. The work is in someone noticing the alert and acting on it. The same month brought PHP2Shell, a flaw in PHP itself, which sits under every WordPress site. If you run WordPress, start with whether PHP2Shell affects your website, then read the questions to ask your web host after an alert.
How do the common setups compare?
Here is how three common setups split the work. Each one can be run well. They hand the patching to different people, and they leave the owner different jobs.
| What is being compared | WordPress with plugins | Wix, Squarespace, Shopify | A static custom build |
|---|---|---|---|
| Who patches it | The host patches the server and PHP. You or your developer update WordPress, the theme and each plugin. | The platform company runs its own servers. | The hosting platform patches its servers, and I update the framework. |
| Plugins | As many as the site has added, each from its own developer. | Apps from the platform’s store, if you add them. | None. Features are part of the site’s own code. |
| Login screen and database on the server | Yes. The admin login and the database both live on the server. | Both live with the platform company. | Neither. The pages are made ahead of time. |
| What the owner manages | Updates, backups, admin accounts, passwords, and the choice of host. | The account password, two-step verification and any apps added. | Business email, passwords, two-factor on the domain registrar, and the Google account. |
If you are weighing a move off WordPress for other reasons too, my guide to alternatives to WordPress for a small business covers cost, speed and the move itself.
What are the limits?
Any website can be broken into, including the ones I build. The framework I build on has had a critical flaw of its own, and some parts of your setup will always be yours to look after.
On December 3, 2025, a flaw called React2Shell (CVE-2025-55182) was disclosed. It was a critical remote code execution flaw in React Server Components, scored 10.0, and attackers used it in the wild. It affected Next.js, the framework I build on. Fixed releases shipped the same day. In the days after, researchers found more flaws in the same code, including one that slipped past an earlier fix and could hang a server. Those needed a second round of updates.
What I can offer is fewer ways in, and someone whose job is to apply the fix when one is found. The accounts around the site stay with you, whatever the site runs on.
- Your business email. A strong password and two-step verification, because every password reset arrives there.
- Your passwords. A password manager, with a different password for every account.
- Two-factor on your domain registrar. Whoever controls the domain controls the website and the email.
- Your Google account, which holds your Business Profile and Search Console.
Three of those accounts have their own guides, on why business emails go to spam, spotting a domain renewal scam and Google scam calls about your listing.
If something does go wrong, my guide to what to do when your website is hacked puts the first hour in order.
Every site can be attacked. Mine are built with fewer ways in, and the fix has an owner.
Sources and further reading
- Help Net Security: critical React and Node.js vulnerability, CVE-2025-55182
Checked October 23, 2026. The React Server Components flaw disclosed on December 3, 2025, the fixed React releases, and the Next.js releases that include the fix.
- Greenbone: React2Shell, a critical React and Next.js flaw, is actively exploited
Checked October 23, 2026. React2Shell scored CVSS 10.0, allowed remote code execution without logging in, and was exploited in the wild.
- NIST National Vulnerability Database: CVE-2025-67779
Checked October 23, 2026. A denial-of-service flaw in React Server Components left open by an incomplete earlier fix, patched in React 19.0.3, 19.1.4 and 19.2.3.
- SecurityWeek: Bricksforge WordPress plugin vulnerability exploited in the wild
Checked October 23, 2026. Exploitation attempts from October 7, 2026, and the fix in version 3.1.8.10.
- Patchstack: PHP major vulnerability alert, October 2026
Checked October 23, 2026. Includes the warning that stolen UpdraftCentral dashboard keys are being used to install backdoors on connected WordPress sites.
Frequently asked questions
Is a static website harder to break into than WordPress?
It has fewer ways in. There is no database or admin login on the server. There are also no plugins to keep updated. A well-kept WordPress site with a good host and few plugins can also be in good shape. The difference is how many parts need patching, and who does it.
Do I need to update a site you build?
The hosting platform patches its servers, and I update the framework. Your part is the accounts around the site. That means your business email, your passwords, two-factor on the domain registrar, and your Google account.
What happens when a flaw is found in the framework?
The fix arrives as a new release of the framework, and applying it is my job. When React2Shell was disclosed on December 3, 2025, fixed releases shipped the same day.
Which account should I lock down first?
Start with your business email, then your domain registrar. Turn on two-step verification for both. Email comes first because every other password reset lands in that inbox.
Related pages
- Professional services websites
- Wellness and clinic websites
- Retail and ecommerce websites
- Remote web design worldwide
- PHP2Shell: Is Your Website Affected?
- What to Ask Your Web Host After a Security Alert
- Is Wix Secure? Wix, Squarespace and Shopify Explained
- Got a Domain Renewal Letter? How to Spot the Scam
Kootenay Made Digital
I build websites, local presence, and calm AI setups for Kootenay small businesses. Prices are published, and the work is built to make you easier to find and easier to choose.
