Five habits do most of the work: install security updates within days, delete software you do not use, put two-factor login on every admin account, keep tested backups away from the server, and know who reports an incident to CERT-In, which wants website defacement reported within six hours.
A small business website stays secure through five habits: install security updates within days, delete software you no longer use, protect every admin account with two-factor authentication, keep backups away from the server and prove they restore, and decide in advance who reports an incident, and to whom. None of this needs a security team, and together these habits address the most common ways in.
Nobody has to pick your business for it to be attacked. Criminals scan the internet for known weaknesses and work through whatever they find, and small firms are not spared. The time you have to react can be a matter of hours: in December 2025 attackers began trying to exploit a critical flaw in React, the library behind many modern websites, within hours of it being made public.
- of breaches at firms with under 1,000 staff involved ransomware, against 39% at larger ones (Verizon)
- 88%
- of breaches at firms with under 1,000 staff involved ransomware, against 39% at larger ones (Verizon)
- of breaches with a known entry point began with credential abuse (Verizon)
- 22%
- of breaches with a known entry point began with credential abuse (Verizon)
- of new WordPress ecosystem vulnerabilities found in 2024 were in plugins (Patchstack)
- 96%
- of new WordPress ecosystem vulnerabilities found in 2024 were in plugins (Patchstack)
- CERT-In's deadline for reporting incidents such as website defacement
- 6 hours
- CERT-In's deadline for reporting incidents such as website defacement
01
Patch in days, because attackers now move in hours
On 3 December 2025 the React team disclosed CVE-2025-55182, soon nicknamed React2Shell. Rated 10.0, the maximum severity score, it let an attacker run code on a server without logging in. It affected sites using React Server Components, including Next.js apps built on the App Router; apps whose React code does not use a server were not affected.
29 Nov
Reported privately
Researcher Lachlan Davidson reports the flaw through Meta's bug bounty programme.
3 Dec
Disclosed and patched
React publishes fixes, and Next.js patches its affected 15 and 16 releases.
3 Dec, hours later
Exploitation begins
Amazon sees exploitation attempts by China-nexus threat groups within hours of the disclosure.
5 Dec
Confirmed in the wild
The US agency CISA adds the flaw to its list of known exploited vulnerabilities, and Shadowserver counts 77,664 vulnerable IP addresses.
6 Dec
Rotate your secrets
Next.js tells apps that were online and unpatched on 4 December to rotate their keys and passwords after patching.
11 Dec
Patch again
React discloses further flaws that allow denial of service and source code exposure, so teams have to update a second time.
Patching usually takes far longer than that. Verizon found exploited vulnerabilities were the way in for 20% of breaches with a known entry point, up 34% on its previous report, and only about 54% of edge-device and VPN flaws were fully fixed during the year, at a median of 32 days. Amazon stressed that even its own automated defences, firewall rules included, are no substitute for patching.
Older stacks carry the same risk in a different shape. Patchstack recorded 7,966 new vulnerabilities in the WordPress ecosystem in 2024: 96% in plugins, just seven in WordPress core, and 33% with no fix by the time they were made public. It also counted 1,614 plugins and themes removed from the WordPress.org directory over unpatched security issues. WordPress has let administrators turn on automatic updates plugin by plugin since version 5.5; on most small sites that switch belongs on.
02
Lock down every account that can change your site
Stolen and guessed passwords are still the most common way in: among the breaches in Verizon's 2025 report where the entry point was known, credential abuse came first, at 22%. Two-factor authentication is one of the cheapest fixes available. Microsoft researchers studying Azure Active Directory accounts that showed suspicious activity found that multi-factor sign-in cut the risk of compromise by 99.22%, and that authenticator apps outperformed SMS codes.
Owners usually protect the website login and forget the rest. Turn on two-factor for every account that could take your site down or redirect it:
- Domain registrar and DNS. Whoever controls these controls your website and your email.
- Hosting or cloud account, including the control panel and any server logins.
- Website admin, for every user with editor or administrator rights.
- Business email, because password resets for everything else arrive there.
- CDN, firewall and code repository, if your site uses them.
03
Shrink what can be attacked
Every plugin, theme, form and forgotten admin account is something an attacker can probe. Google's guidance for site owners calls outdated or unpatched themes and plugins a major source of vulnerabilities, advises removing those no longer maintained, and says to delete a removed plugin's files from the server rather than only disabling it. It also warns that attackers plant malicious code in free copies of paid plugins and themes from untrusted sites, so a pirated premium theme is a liability, not a saving.
Architecture helps too. A statically generated site serves pre-built pages, with no database or plugin code running when a visitor arrives, so there is far less to attack. React2Shell is the caveat: it struck modern frameworks where they run code on the server, so they need the same update discipline.
04
Backups only count if they restore
When something does go wrong, a clean backup is the difference between an afternoon's work and a rebuild. CISA, the US cybersecurity agency, advises keeping offline, encrypted backups of critical data and testing them regularly, because many ransomware strains hunt for reachable backups to delete or encrypt. Verizon notes that smaller firms are less likely to have up-to-date, readily available backups, which it calls a bonus for the attacker.
For a small website that means automatic daily backups stored away from the server, at least one copy in an account you control rather than only with your host, and a restore you have actually carried out. An untested backup is a hope, not a plan.
ransomware groups don't seem to care what size an organization is; they are quite happy to breach smaller organizations and adjust their ransom demands accordingly.
05
Know what India's rules expect
CERT-In's directions of April 2022 apply to service providers, intermediaries, data centres, body corporates and government organisations. They require listed cyber incidents, including website defacement and intrusion, malicious code, data breaches and data leaks, to be reported to incident@cert-in.org.in within six hours of noticing them. Logs of ICT systems must be kept securely for a rolling 180 days within India.
Data protection law adds a second layer. India notified its Digital Personal Data Protection Rules in November 2025 with an 18-month phase-in, so most duties, including the security and breach rules, apply from May 2027. Failing to take reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to report a breach up to ₹200 crore.
| Rule | In force | What it asks of you |
|---|---|---|
| CERT-In directions | Since 2022 | Report website defacement, intrusion, data breaches and leaks within 6 hours, and keep ICT logs for 180 days in India |
| DPDP Rules: security safeguards | From May 2027 | Encryption or masking, access controls, logging and monitoring, backups, and logs kept for one year |
| DPDP Rules: breach notice | From May 2027 | Tell affected people without delay, alert the Data Protection Board, and send it a detailed report within 72 hours |
06
The quarterly half-hour
Put this in the calendar every three months:
- Update the CMS, plugins, themes and server software, and confirm automatic updates still run.
- Delete unused plugins, themes, admin accounts and old test sites.
- Confirm two-factor is on for the registrar, hosting, website admin, email and CDN.
- Restore a recent backup to a test copy and check that it works.
- Check that your PHP or Node.js version still receives security fixes.
- Write down who reports an incident to CERT-In, and how.
Sources
Facts current as of 19 December 2025.