{"id":3378,"date":"2026-09-19T19:34:30","date_gmt":"2026-09-20T00:34:30","guid":{"rendered":"https:\/\/minnovatenetworks.com\/blog\/your-website-is-a-security-problem\/"},"modified":"2026-09-19T19:34:30","modified_gmt":"2026-09-20T00:34:30","slug":"your-website-is-a-security-problem","status":"publish","type":"post","link":"https:\/\/minnovatenetworks.com\/blog\/your-website-is-a-security-problem\/","title":{"rendered":"Your website is a security problem wearing a marketing costume"},"content":{"rendered":"<p>Ask a practice who owns the website and you usually get a pause, then a name. A cousin. A marketing agency from four years ago. The office manager who set it up and has since left. Almost never IT, because a website feels like marketing, and marketing does not patch things.<\/p>\n<p>That gap is the whole problem. A website is a public server running somebody else&#8217;s code, on the open internet, under your name. It just happens to have pictures of your reception area on it.<\/p>\n<h2>What actually goes wrong<\/h2>\n<p>Sites are rarely hacked in the way people imagine, with somebody deliberately targeting your practice. What happens is duller and far more common: an automated scanner finds a known vulnerability in a plugin you forgot you installed, and exploits it the same day.<\/p>\n<p>The damage tends to be one of these, in rough order of how often we see it:<\/p>\n<ul>\n<li><strong>Search spam injection.<\/strong> Hidden pages get added to your site selling pharmaceuticals or counterfeit goods. You cannot see them. Google can. Your search rankings collapse and you have no idea why.<\/li>\n<li><strong>Redirects.<\/strong> Visitors from Google get bounced somewhere else, but anyone typing your address directly sees a normal site. So you and your staff see nothing wrong for weeks.<\/li>\n<li><strong>A card skimmer or fake form.<\/strong> Anywhere a patient types anything becomes a place to collect it.<\/li>\n<li><strong>Mail relay.<\/strong> Your server gets used to send spam, your domain ends up on a blocklist, and suddenly your appointment reminders stop arriving.<\/li>\n<li><strong>Straightforward defacement.<\/strong> Rare, but at least you find out immediately.<\/li>\n<\/ul>\n<p>That fourth one deserves emphasis, because it is the one that surprises people. A compromised website can poison the reputation of the domain your email runs on. The website and the mailbox feel like separate things. To a spam filter they are the same name.<\/p>\n<h2>Why it is nearly always out of date<\/h2>\n<p>A site gets built, launched, admired, paid for. Then the project ends. There is no maintenance line in the budget because nothing appears to need maintaining: the site looks exactly the same on Tuesday as it did on Monday.<\/p>\n<p>Meanwhile the platform underneath it publishes security updates roughly constantly. WordPress powers a large share of small business sites, and its plugin ecosystem is where most of the risk lives. A plugin gets abandoned by its author, a vulnerability is published, and every site still running it is now on a list that anyone can scan for.<\/p>\n<p>The uncomfortable part: <strong>the plugin you are most likely to be compromised through is one you are not using.<\/strong> Deactivated is not removed. An inactive plugin still has its files sitting there, still reachable, still exploitable in many cases.<\/p>\n<h2>Five questions worth asking about your own site<\/h2>\n<p>You can answer most of these without anything technical:<\/p>\n<ol>\n<li><strong>Who logs in, and do any of them still work here?<\/strong> Old agency accounts and former staff accounts are extremely common, and they usually have full administrative rights.<\/li>\n<li><strong>When was it last updated?<\/strong> Not the content. The platform and the plugins.<\/li>\n<li><strong>Is there a backup, and has anyone restored from it?<\/strong> Your host may take one. Whether you can actually get it back, and how long that takes, is a different question.<\/li>\n<li><strong>Who gets told if it goes down?<\/strong> If the answer is &#8220;we notice eventually&#8221;, the answer is nobody.<\/li>\n<li><strong>Who controls the domain name?<\/strong> This one matters more than the site. If your domain registration lapses or sits in someone else&#8217;s account, you can lose the website and every email address at once. Domains should be registered in the business&#8217;s name, always.<\/li>\n<\/ol>\n<p>If several of those made you uncomfortable, that is the normal result. It is not a sign anyone was negligent; it is a sign the site fell between marketing and IT and landed with nobody.<\/p>\n<h2>What maintaining a site actually involves<\/h2>\n<p>Less than people expect, which is why the neglect is so frustrating. A maintained site means:<\/p>\n<ul>\n<li>Platform and plugin updates applied on a schedule, with a staging check before anything touches the live site.<\/li>\n<li>Unused plugins and themes removed rather than deactivated.<\/li>\n<li>Backups running offsite, tested by actually restoring one.<\/li>\n<li>Uptime and certificate monitoring, so an expired certificate is not discovered by a patient seeing a browser warning.<\/li>\n<li>Administrator accounts reviewed, with multi-factor on every one that remains.<\/li>\n<li>The domain registration in your name, with the renewal on somebody&#8217;s calendar.<\/li>\n<\/ul>\n<p>None of that is glamorous and none of it takes long. It simply has to be somebody&#8217;s job, on a recurring basis, forever.<\/p>\n<h2>The honest recommendation<\/h2>\n<p>If your site works and you are happy with how it looks, you may not need a new one. What you probably need is for somebody to take responsibility for keeping it running and keeping it clean. That is usually a much smaller conversation than a rebuild, and it closes the actual risk.<\/p>\n<p>If the site is genuinely past it, rebuild it, but insist that hosting and maintenance are part of the arrangement rather than a handover at the end. A site with nobody looking after it will be back in exactly this state within two years, whoever builds it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Nobody assigns the practice website to IT, so nobody patches it. Then it starts serving pharmacy spam to Google and the first you hear about it is from a patient.<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[76],"tags":[79,80,77,78],"class_list":["post-3378","post","type-post","status-publish","format-standard","hentry","category-websites","tag-hosting","tag-maintenance","tag-websites","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/minnovatenetworks.com\/blog\/wp-json\/wp\/v2\/posts\/3378","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/minnovatenetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/minnovatenetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/minnovatenetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=3378"}],"version-history":[{"count":0,"href":"https:\/\/minnovatenetworks.com\/blog\/wp-json\/wp\/v2\/posts\/3378\/revisions"}],"wp:attachment":[{"href":"https:\/\/minnovatenetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=3378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/minnovatenetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=3378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/minnovatenetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=3378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}