A client called me because their website had "gone weird". It was running a cryptominer for somebody else, quietly, on their hosting account. Here is how that happens and how you avoid it.

How sites get taken over

Almost never by someone targeting your business personally. Automated scanners crawl the internet looking for known weaknesses in outdated plugins and themes. When a vulnerability becomes public, the plugin author patches it, and every site that has not applied the update becomes a listed address on someone's scan.

That is the uncomfortable part. The security hole is public knowledge. The only thing standing between your site and it is whether someone clicked update.

What an infected site actually costs

• Cleanup time, usually charged by the hour
• Hosting suspension while the host investigates
• Google flagging your site as unsafe, which takes days to reverse
• Rankings dropping while the site is down or flagged
• Customers who saw the warning and will not try again

Compared with a monthly maintenance fee, it is not close.

The five habits that prevent nearly all of it

• Update monthly, and check the site afterwards. Core, themes and plugins. Then load the site and test the contact form, because updates occasionally break things quietly.
• Delete what you do not use. A deactivated plugin still sits on the server and can still be exploited. Remove it properly.
• Strong, unique admin passwords, with two-factor. "Business2024" is not a password, it is an invitation.
• Off-site backups, tested. Backups stored on the same server are worthless if the server is the problem.
• Limit admin accounts. The person who writes blog posts does not need administrator rights.

If you think you are already infected

Signs include unexpected redirects, pop-ups you did not add, new admin users, a sudden slowdown, or your host emailing about resource usage. Do not just delete the visible symptom. Take the site offline, restore from a clean backup taken before the infection, then patch everything before putting it back up. Changing every password afterwards is not optional.

Maintenance is dull work. So is insurance, right up until the week you need it.