Website Security: What South African Businesses Actually Need

Nobody is sitting at a desk somewhere deciding to hack your guesthouse website.

That’s the first thing worth understanding, because it’s the reason most small business owners don’t bother with security. They assume they’re too small to be a target — and they’re right. They’re not a target. They’re a result.

Automated bots scan the entire internet, constantly, looking for known weaknesses. They don’t care who you are. They find an outdated plugin, they get in, and nobody notices for weeks.

Here’s what actually protects you.

What getting hacked looks like in practice

It’s rarely dramatic. More often it’s one of these:

Spam pages injected into your site. Hundreds of pages selling counterfeit goods, invisible to you, very visible to Google. Your rankings collapse and you have no idea why.

Redirects. Visitors on mobile get bounced to a scam site. You test on your desktop, see nothing wrong, and assume the complaints are user error.

Your site used to send spam. Your domain lands on blacklists. Suddenly your quotes stop arriving in clients’ inboxes.

Defacement or ransom. The rarer, obvious version.

Customer data taken. The expensive one, and the one with legal consequences in South Africa.

The pattern worth noticing: most of these are silent. The damage is done long before anyone spots it.

How they actually get in

Four routes, in rough order of frequency.

Outdated plugins and themes. By a wide margin the most common. When a plugin vulnerability is disclosed publicly, bots start scanning for unpatched sites within hours. A plugin you installed two years ago and forgot about is the usual culprit.

Weak passwords and no two-factor. Bots try thousands of common password combinations against WordPress login pages continuously. “Admin123” takes seconds.

Abandoned plugins. A plugin whose developer stopped updating it three years ago is a permanent open window. It still works, which is why nobody removes it.

Cheap shared hosting. On poorly managed shared hosting, one compromised site on the server can affect others. You can do everything right and still get caught.

Notice what isn’t on this list: sophisticated targeted attacks. For a small South African business, that’s almost never what happens.

The things that actually matter

Keep everything updated

This single habit prevents the majority of small business compromises.

WordPress core, plugins, themes — all of them, regularly. Not “when I remember.” Weekly, or automated with a backup safety net.

The reason people don’t: updates occasionally break things, especially on sites built with page builders and heavily customised themes. That fear is legitimate. The answer isn’t to stop updating — it’s to back up first and have a way to roll back.

Backups you’ve actually tested

A backup you’ve never restored is a guess.

• Offsite. A backup living on the same server as the site is worthless if the server is compromised.
• Automated. Manual backups stop happening within a month.
• Multiple versions. If a hack went unnoticed for three weeks, yesterday’s backup is also infected. Keep a month of history.
• Tested. Restore one to a staging environment at least once so you know the process works.

If you only do two things from this article, make them updates and tested offsite backups.

Strong passwords and two-factor authentication

Use a password manager. Different password per site. Two-factor on every admin account — WordPress has free plugins for this and it takes ten minutes.

Remove accounts you don’t use. The developer who built the site in 2021, the staff member who left, the “temp” account from a plugin trial. Every dormant admin account is a way in.

Don’t use “admin” as a username. It’s the first thing bots try.

Give people the least access they need

Not everyone needs to be an Administrator. Someone who writes blog posts should be an Editor or Author. A compromised Author account is a nuisance; a compromised Administrator account is a rebuild.

SSL, properly

Every site needs HTTPS. It’s expected, it affects rankings, and browsers flag sites without it.

Most decent South African hosts include a free certificate. Two things people get wrong:

• Mixed content — the certificate is installed but some images or scripts still load over HTTP, so the padlock doesn’t show. A plugin or a search-replace fixes it.
• Expiry — if it isn’t auto-renewing, you’ll find out when visitors get a full-page browser warning.

A security plugin, configured

One is enough. Wordfence, Solid Security and similar all do the job. What matters is configuring it rather than installing and forgetting.

Worth enabling: login attempt limiting, two-factor, file change detection, malware scanning.

Don’t run two security plugins at once. They conflict, and you’ll spend an afternoon debugging a problem you created.

Hosting that isn’t the cheapest thing available

R20/month shared hosting with no isolation, no backups and no support is a false economy. When something goes wrong — and it will — you’ll discover there’s nobody to call.

Decent hosting gives you server-level isolation, automated backups, a staging environment and support that answers. For most small SA business sites that’s somewhere between R150 and R600 a month.

The POPIA angle

This is where a hacked website stops being an IT problem and becomes a legal one.

If your site collects personal information — contact forms, bookings, customer accounts, an e-commerce checkout — you are responsible for securing it. POPIA requires reasonable technical measures to protect personal information you hold.

If there’s a breach, you must notify the Information Regulator and, in most cases, the affected people. “We didn’t know the plugin was out of date” is not a defence.

For a guesthouse holding guest details, a dealership holding finance enquiries, or any store holding customer addresses, this is a real exposure. The security work isn’t optional housekeeping — it’s part of your compliance position.

General guidance, not legal advice.

What to do if you’ve been hacked

Don’t panic-delete things. You’ll destroy evidence of how they got in and probably break the site further.

1. Take the site offline or into maintenance mode
2. Change all passwords — WordPress, hosting, FTP, database
3. Tell your host; many will help, and they may already know
4. Restore from a clean backup from before the compromise
5. Update everything before putting it back online
6. Find the entry point, or it happens again
7. If personal information was exposed, deal with the POPIA notification obligation

Then check Google. Search Console will tell you if your site has been flagged. Request a review once it’s clean, or the warning stays.

If you’re not confident, get help. A badly cleaned hack usually comes back.

What it costs

Don’t want to think about any of this? Our maintenance plans cover updates, backups, security monitoring and malware scanning from R550/month — no long-term contracts.