Why hackers are interested in a small website
People often assume only big websites are targeted. In reality, many attacks are automated: programs crawl the web looking for known weaknesses, regardless of the size of the business. A forgotten website with a plugin that has never been updated is an easy target.
The consequences are real: website offline, damaged reputation, fraudulent messages sent in your name, customer data exposed. The good news is that a few simple measures close most of the doors.
The essential measures
Update, without waiting
Cybermalveillance.gouv.fr points out that software and devices contain weaknesses that vendors fix through updates. Its advice: apply them as soon as they are available, turn on automatic updates where possible and download them only from official websites or channels. For a website, this covers the site engine (CMS), its plugins and themes, and also the computers you use to log in to it.
- List everything your website is made of: nothing should be forgotten.
- Remove plugins you no longer use.
- Back up before a major update.
- Beware of fake update alerts in advertising pop-ups.
Back up, and check the backup works
The public service advises backing up regularly, keeping several copies including one in a different place from the original data, keeping a copy on a disconnected medium and regularly checking that the backup works, for example by restoring it. For a website, ask where the backups are stored, how often they are made and whether a restore has ever been tested.
Strong passwords and two-factor authentication
Cybermalveillance.gouv.fr recommends long, complex passwords that are different for each account, a password manager, and two-factor authentication whenever possible. This applies to the website admin, the hosting, the domain name and your email: a hacker who takes over your email can reset every other access.
Keep work and personal use apart
Another piece of advice from the service: keep personal and professional use separate (devices, email accounts, storage) to limit the impact of a hack. Also avoid public or unknown Wi-Fi networks when logging in to your website’s admin.
Points specific to a website
Beyond the general measures, a few checks apply directly to your website:
- The address starts with https and the browser shows no security warning.
- Everyone who works on the website has their own account, with only the rights they need.
- Accounts belonging to former suppliers or employees are deleted.
- Forms collect only the information needed, and messages received are not stored indefinitely.
- You know who to contact, and how, if the website goes down or shows strange content.
What to ask your supplier
If a supplier manages your website, security depends largely on them. Ask precise questions: who does the updates, how often, where the backups are, how a restore works, who holds the administrator access. A vague answer is already a warning sign.
With us, the monthly fee for websites includes hosting and maintenance, as well as small changes (text, photos, opening hours). Hosting is chosen with you, including in Europe, and you keep your access. Our showcase websites start from €490 excl. VAT then €15 excl. VAT per month.
What if the website is already old?
A website built long ago, on components that are no longer maintained, can cost more to secure than to rebuild. Our free diagnostic checks in a few seconds whether your website uses https and displays correctly on a phone: a first reference point before you decide.
If something goes wrong
If your website shows content you did not publish, or you lose access to an account, tell your supplier or host immediately, change the passwords concerned from a clean device and keep anything useful (screenshots, messages received).
Information checked on 4 November 2026 on cybermalveillance.gouv.fr. This guide gives general pointers and does not replace a security audit.