Privacy & Security
Why Bots Attack Small Business Websites (and How We Block Them)
Even a small business website gets probed by bots every day. What they look for, what we found on our own old site, and the security steps every business website needs.
Many business owners think, "Who would bother hacking my small website?" The answer is: nobody personally. Bots do it automatically, scanning millions of websites every day looking for an easy way in.
We saw this first-hand on our own old website, so here's what we found and how we fixed it.
What bots look for
Look at the access logs of almost any website and you'll see requests for pages that don't exist on it:
- /wp-login.php and /wp-admin — trying to log in to WordPress
- /xmlrpc.php — an old WordPress feature often abused for password guessing
- /.env — a file that can contain database passwords and API keys
- /.git/config — a sign the site's source code might be downloadable
- /phpmyadmin — a database admin tool
Bots don't care whether your site uses WordPress. They try everything, everywhere, and wait for one door to open.
What we found on our own site
When we audited the old Focused Folks website before redesigning it:
- Bots were regularly probing for WordPress and PHP files
- The site's dependencies had 12 known vulnerabilities, one of them critical
- Security headers that tell browsers how to protect visitors were missing
None of this was visible from the outside. The site looked fine.
How we hardened it
- Blocked probe paths. Requests for WordPress, PHP, .env, .git and database-tool paths now get a plain "Not Found" before they reach the application.
- Refused unexpected requests. Only the contact form and the protected admin area accept submissions; every other page is read-only.
- Patched everything. We upgraded the framework and dependencies until the security audit showed zero known vulnerabilities.
- Added security headers. A content security policy, HTTPS-only, no framing by other sites and strict referrer rules.
- Added a spam trap. A hidden field on the contact form catches bots without annoying real visitors.
- Checked for secrets. No passwords or keys in the code; they live only in the hosting environment.
Then we replayed 13 common attacks against the new site. Every one was blocked, and every real page kept working.
A security checklist for any business website
- HTTPS on every page
- Software, plugins and themes kept up to date
- Strong, unique admin passwords and two-factor login
- Admin area hidden from search engines and protected
- Regular, tested backups
- Spam protection on forms
- Security headers configured
- Someone responsible for checking it every month
Why it matters for your business
A hacked website can redirect visitors to scam pages, send spam from your domain, leak customer enquiries or get flagged by Google with a warning. Under India's new data protection rules, leaking customer data also carries legal duties. Prevention costs far less than recovery.
- Website security
- Small business website security
- WordPress attacks
- Secure website development
- Website maintenance
