The Hacked-Site Problem: Keeping a Small Shop's Website Safe

At some point somebody asks you who is in charge of your website’s security, and the honest answer is nobody. That is far more common than you would think, and it is the single biggest reason a small business website gets compromised. Not a targeted attack from someone who has a problem with your garage door shop specifically. Just neglect that finally caught up with it.

This one is for the owner who already has a website, probably self-hosted WordPress that a freelancer or a relative set up a few years back, and wants two plain answers: is it actually at risk, and what do you do about it without turning into a computer person. By the end you will know what really gets hacked and why, what a compromise costs you in the weeks after, and the four habits that prevent almost all of it. One disclosure up front: we build and sell garage door company websites, so we are not a neutral referee here. The mechanics of how a site gets compromised do not change based on who is explaining them, and we would rather you know them than not.

The short answer

A self-hosted WordPress site that nobody is maintaining is the riskiest option on this list, by a wide margin. If that describes your site, do one of two things. Either assign someone the four habits below, starting this week, or move to a platform that removes the job from your plate entirely. The rest of this article is why.

How the options compare on security

Option	Typical cost	Who patches security	Where it gets hard
Self-hosted WordPress	Software is free; budget hosting like Hostinger runs about $3 to $11/mo, more with a premium host (checked 2026-08-28)	You, or whoever you assign it to	Nobody’s job unless someone was hired to do it. This is the option that actually gets hacked.
Managed WordPress (WP Engine, Kinsta)	WP Engine from $30/mo; Kinsta from $35/mo (checked 2026-08-28)	The host handles the server layer; you still choose the plugins	Real ongoing cost, and a plugin you install yourself is still your problem
Wix or Squarespace	Wix Core runs about $29 to $30/mo billed annually; Squarespace’s Core plan is $29/mo annual after its July 2026 repricing (checked 2026-08-28)	The platform, entirely. No core or plugins for you to patch.	You are renting, not owning. Leave the platform and you rebuild from nothing.
Static hosting (Vercel, Netlify, Cloudflare Pages)	Vercel’s Pro tier is $20/mo; free tiers are common across the category (checked 2026-08-28)	Nobody has to. There is no database or plugin layer to attack.	Not built for a site an owner wants to log in and edit like a document

What actually gets hacked, and why

Nobody is running a targeted campaign against garage door companies. What is actually happening is automated: bots that continuously scan websites at scale, fingerprint what software and plugin versions each one is running, and check that list against a database of known vulnerabilities. When a scan finds a WordPress site running a plugin version with a documented hole, it tries the known exploit automatically. No human ever looks at your site before it happens.

That is why “we’re too small to be a target” is exactly backwards. Size has nothing to do with it. An unpatched plugin on a two-truck garage door shop’s site is just as exploitable as the same unpatched plugin on a national chain’s site, and the bot does not know or care which one it found.

The freedom-and-responsibility trade

Self-hosted WordPress gives you full ownership: your domain, your hosting account, your database, every file. Nobody can hold that hostage. It also hands you the full maintenance obligation that comes with owning it. Nobody assigns that job to you when you launch the site. It just sits there, unassigned, until something breaks.

What a compromise actually costs you

The hack itself is rarely the expensive part. The weeks after are. A compromised site commonly gets used to host spam pages, redirect visitors to another site, or serve malware, and once that happens a few things tend to follow in order.

Your host may suspend the account outright, taking the whole site offline with no notice. If Google’s own crawlers flag the malicious content, browsers start showing visitors a red warning page before they can even load your site. Your search results can fill with spammy page titles that have nothing to do with garage doors, which is its own kind of embarrassing when a customer searches your business name. And anyone who visited during the compromise, or who saw the warning screen, remembers it. Cleaning the infection does not clear any of that on its own. Once you request Google’s review, that review typically takes anywhere from a few days to a few weeks, and only once it clears does the warning come down, so the whole process runs weeks, not a day (checked 2026-08-28).

Habit one: updates on a schedule

Core WordPress and every plugin need updates on a set cadence, not “whenever someone remembers.” Monthly is reasonable for a small shop’s site. If a plugin has broken something on an update before, add a staging step: update it on a copy of the site first, confirm nothing broke, then push it live. That single habit closes the door most automated scans are trying.

Habit two: backups you actually control

A backup that lives only inside your hosting account is not a real backup. If that account gets compromised or suspended, the backup can go down with it. A real backup is stored somewhere independent of the host, and it is tested, meaning someone has actually restored it once to confirm it works. An untested backup is a hope, not a plan.

Habit three: subtraction

Every plugin, theme, and user account you are not actively using is surface area a scanner can exploit, whether or not it is switched on. Deactivated is not the same as deleted. Removing what you do not use is the cheapest, fastest security work available to a small shop, and most sites GDW reviews are carrying plugins nobody remembers installing.

Habit four: access hygiene

Know who has admin access to your site right now, by name. The freelancer who built it three years ago and vanished. The employee who left last spring. Every one of those logins is a door that should have been closed the day the relationship ended, and most owners have never checked.

That same audit is worth running past your website. Old logins tend to pile up anywhere a business grants access, and it is worth doing the same pass on your CRM, your phone system, and whatever field service software runs your scheduling and dispatch. Our sister brand, Garage Door Lead Engine, covers that side of the business in its guide to field service software for garage door companies, since keeping stray access out of your operations tools is a related but separate job from keeping your website patched.

One more thing worth saying plainly: SSL, the padlock icon and the “https” in your address bar, is free on every host worth using in 2026. It is table stakes, not real security. A site can have a perfect padlock and still run a plugin with a known exploit sitting wide open underneath it.

Where each platform actually sits, honestly

On pure security, closed platforms like Wix win this one cleanly, and we should say so without hedging. There is no core software for you to patch, no plugin ecosystem for a bot to fingerprint, no server configuration for you to get wrong. The platform patches itself, for everyone, all the time. If security were the only thing that mattered, this article would end here.

It is not the only thing that matters, so here is the honest trade. Buying that security means giving up portability. A Wix or Squarespace site cannot be exported to run somewhere else; leaving means rebuilding from scratch. Managed WordPress hosts like WP Engine and Kinsta split the difference: they patch the server layer and handle a lot of the operational burden, but the plugins you choose to install are still yours to maintain, and you are paying $30 to $35 a month and up for that coverage. Static hosting has almost nothing to attack in the first place, since there is no database or admin login to break into, but it is not built for an owner who wants to log in and edit a page like a document. A bare self-hosted install has all of it on you, full stop, and unattended it is the highest-risk option on this entire list.

What usually goes wrong

The pattern GDW sees repeatedly, when auditing an old contractor-built site, looks like this. A freelancer or a local shop built a WordPress site a few years ago, handed over a login, and moved on. Nobody was ever assigned to maintain it afterward, because nobody thought to ask who would. The plugins sat at whatever version they were installed at. Eighteen months to two years in, an automated scan finds a known vulnerability in one of them, and the site gets compromised without anyone noticing for weeks, because nobody was checking it. The owner finds out from a customer who mentions their browser flagged the site, or from a sudden drop in calls that traces back to a search listing full of spam titles.

A secured, well-maintained website only protects the traffic that reaches it. What happens after someone fills out your contact form is a different system entirely, and it is worth knowing that too. Garage Door Lead Engine, our sister brand, has written specifically about the gap between generating a lead and actually converting it in their guide on why leads don’t convert and systems do. That is deliberately not something we cover here, since it is a different problem than the one this article is solving.

How to tell you got it right

Run this five-minute check on your own site, or on whoever maintains it for you. Log into wp-admin, if that applies, and check the “last updated” date on your theme and every plugin. Anything more than two or three months stale is a gap. Look at the list of admin users and ask whether you recognize every name on it. Confirm there is a backup, ask when it was last tested by an actual restore rather than just taken, and ask where it is stored. And ask the one question that cuts through everything else: “who is responsible for updating this site, and how often does it happen.” If the honest answer is “nobody” or a long pause, that is the answer this whole article was trying to help you find.

If you are not sure what your current site is even running on, that is worth figuring out before anything else. Our guide to what a garage door website costs covers what you should expect to pay for upkeep either way, and our garage door company website checklist is a good next stop for the rest of what a site needs beyond security.