There is a particular kind of website that worries us more than a busy one: the site that works, gets a trickle of visitors, and has not been logged into since it was built.
Nobody is neglecting it deliberately. It simply never asks for anything.
Why It Is The Risky One
A site that is actively worked on gets updated as a side effect. Someone logs in, sees the notices, clicks update. A site nobody visits accumulates every vulnerability disclosed since the day it launched.
Automated scanners do not care that it is a small local business with forty visitors a month. They care that it answers, and that it is running a version with a known hole. Low traffic is not protection, it is just less chance you will notice when something changes.
What It Turns Into
Rarely anything dramatic. Usually spam pages added in a directory you never look at, hidden links injected for someone else's SEO, or a mail script quietly sending from your domain.
The consequences land elsewhere. Your domain's sending reputation degrades, so your ordinary business email starts going to spam. Or search engines flag the site, and the first you hear is a customer saying Google warned them about you.
The Twenty Minute Fix
Log in. Update WordPress, the theme and every plugin. Delete plugins and themes you are not using, including the default ones. Change the admin password to something not reused anywhere. Check the user list for accounts you do not recognise.
Then set a calendar reminder for every three months and do it again. That is the whole maintenance routine for a small site.
What We Do From Our Side
We scan hosted accounts for known malware and will contact you if something appears. We keep backups off the server so there is a clean copy to go back to.
What we cannot do is press update for you. If you have a site like this, it is worth twenty minutes this week rather than a day of cleanup later.
