Small business sites do get compromised, and the reality is more mundane than people expect. Nobody targeted you. A script found a known vulnerability in something you were running and used it.
How It Almost Always Happens
An out of date plugin or theme. That is the overwhelming majority. A vulnerability is published, automated scanners start sweeping the whole internet for sites still running the vulnerable version, and yours answers.
The gap between disclosure and mass exploitation is often measured in days. This is why "I will update it when I get a chance" is riskier than it feels.
The other common routes are a reused admin password that appeared in someone else's breach, and an abandoned install. A staging copy at /old or /test that nobody patches because nobody remembers it exists.
What The Attacker Usually Wants
Rarely your data. Usually your server and your domain's reputation. Compromised sites get used to send spam, host phishing pages, or inject hidden links to boost someone else's search rankings.
Which is why you can be compromised for weeks without noticing. The site looks completely normal to you. It behaves differently for search engines, or for visitors arriving from Google, or only on mobile.
What To Actually Do
Change passwords first, including database and FTP, because whatever got in may still have access. Then restore from a backup taken before the compromise, which is where retention length suddenly matters a great deal.
Do not simply delete the visible damage. Cleaning the defaced page while leaving the backdoor means you will be doing this again next week. If you cannot identify how they got in, restoring from a clean backup and updating everything is more reliable than picking through it.
Then update, and keep updating. Unglamorous, and it prevents most of this.
Where We Come In
We scan hosted accounts for known malware signatures and will tell you if something looks wrong. We keep backups off the server so a compromise cannot take them with it.
What we cannot do is keep your plugins updated for you. That part is yours, and it is the part that matters most.
