Your website is a security problem wearing a marketing costume

Ask a practice who owns the website and you usually get a pause, then a name. A cousin. A marketing agency from four years ago. The office manager who set it up and has since left. Almost never IT, because a website feels like marketing, and marketing does not patch things.

That gap is the whole problem. A website is a public server running somebody else’s code, on the open internet, under your name. It just happens to have pictures of your reception area on it.

What actually goes wrong

Sites are rarely hacked in the way people imagine, with somebody deliberately targeting your practice. What happens is duller and far more common: an automated scanner finds a known vulnerability in a plugin you forgot you installed, and exploits it the same day.

The damage tends to be one of these, in rough order of how often we see it:

• Search spam injection. Hidden pages get added to your site selling pharmaceuticals or counterfeit goods. You cannot see them. Google can. Your search rankings collapse and you have no idea why.
• Redirects. Visitors from Google get bounced somewhere else, but anyone typing your address directly sees a normal site. So you and your staff see nothing wrong for weeks.
• A card skimmer or fake form. Anywhere a patient types anything becomes a place to collect it.
• Mail relay. Your server gets used to send spam, your domain ends up on a blocklist, and suddenly your appointment reminders stop arriving.
• Straightforward defacement. Rare, but at least you find out immediately.

That fourth one deserves emphasis, because it is the one that surprises people. A compromised website can poison the reputation of the domain your email runs on. The website and the mailbox feel like separate things. To a spam filter they are the same name.

Why it is nearly always out of date

A site gets built, launched, admired, paid for. Then the project ends. There is no maintenance line in the budget because nothing appears to need maintaining: the site looks exactly the same on Tuesday as it did on Monday.

Meanwhile the platform underneath it publishes security updates roughly constantly. WordPress powers a large share of small business sites, and its plugin ecosystem is where most of the risk lives. A plugin gets abandoned by its author, a vulnerability is published, and every site still running it is now on a list that anyone can scan for.

The uncomfortable part: the plugin you are most likely to be compromised through is one you are not using. Deactivated is not removed. An inactive plugin still has its files sitting there, still reachable, still exploitable in many cases.

Five questions worth asking about your own site

You can answer most of these without anything technical:

1. Who logs in, and do any of them still work here? Old agency accounts and former staff accounts are extremely common, and they usually have full administrative rights.
2. When was it last updated? Not the content. The platform and the plugins.
3. Is there a backup, and has anyone restored from it? Your host may take one. Whether you can actually get it back, and how long that takes, is a different question.
4. Who gets told if it goes down? If the answer is “we notice eventually”, the answer is nobody.
5. Who controls the domain name? This one matters more than the site. If your domain registration lapses or sits in someone else’s account, you can lose the website and every email address at once. Domains should be registered in the business’s name, always.

If several of those made you uncomfortable, that is the normal result. It is not a sign anyone was negligent; it is a sign the site fell between marketing and IT and landed with nobody.

What maintaining a site actually involves

Less than people expect, which is why the neglect is so frustrating. A maintained site means:

• Platform and plugin updates applied on a schedule, with a staging check before anything touches the live site.
• Unused plugins and themes removed rather than deactivated.
• Backups running offsite, tested by actually restoring one.
• Uptime and certificate monitoring, so an expired certificate is not discovered by a patient seeing a browser warning.
• Administrator accounts reviewed, with multi-factor on every one that remains.
• The domain registration in your name, with the renewal on somebody’s calendar.

None of that is glamorous and none of it takes long. It simply has to be somebody’s job, on a recurring basis, forever.

The honest recommendation

If your site works and you are happy with how it looks, you may not need a new one. What you probably need is for somebody to take responsibility for keeping it running and keeping it clean. That is usually a much smaller conversation than a rebuild, and it closes the actual risk.

If the site is genuinely past it, rebuild it, but insist that hosting and maintenance are part of the arrangement rather than a handover at the end. A site with nobody looking after it will be back in exactly this state within two years, whoever builds it.