You have probably had an email this week telling you to update something. It is easy to file that under "later." But the gap between a vulnerability being announced and a website being attacked is now measured in hours, not months. Understanding what is actually happening in that window changes how urgently you treat it.
A vulnerability is a mistake in code. That is all it is. Somebody wrote a piece of software, and in one small corner of it they made an assumption that turns out not to hold true. An attacker who finds that assumption can make the software behave in a way it was never designed to.
Think of your website as a building. The walls, the doors and the locks are all software. A vulnerability is not a door left open - it is a door that looks perfectly shut, but where the lock was manufactured with a flaw that lets a particular shape of key turn it anyway. Nobody notices until somebody works out the shape of that key and publishes it.
That publishing part matters. Security researchers find these flaws and report them. The software vendor releases a patch. The flaw is then written up publicly so that everyone knows to update. But the moment it becomes public, every attacker on the internet also knows exactly which lock is faulty and what key opens it. They then scan the entire web looking for buildings that have not changed the lock yet.
Most websites are built on PHP, including WordPress, Magento and countless custom-built systems. Here is a simplified illustration of the kind of mistake that creates a vulnerability. Imagine a page that greets a visitor by name, taking the name from the web address:
<?php
$name = $_GET['name'];
echo "Welcome back, " . $name;
?>This looks harmless. The developer assumed the visitor would type their name. But nothing in that code forces that assumption to be true. A visitor can type anything at all into that part of the address, including instructions for the browser rather than an actual name. The page dutifully prints whatever it is given straight onto the screen, and the visitor's browser cannot tell the difference between content the site intended and content an attacker inserted.
The fix is not complicated. It is simply a matter of never trusting input:
<?php
$name = htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
echo "Welcome back, " . $name;
?>That one function tells PHP to treat the input as plain text and nothing more. The same principle applies everywhere in web development. When a site asks a database a question, the visitor's input must be kept separate from the question itself, or an attacker can change the question. When a site accepts a file upload, it must check what the file actually is, or somebody uploads a program instead of a photo. When a site checks whether you are logged in, it has to check on every single page, or somebody skips the front door entirely.
Almost every vulnerability you will ever read about is a variation on one theme: somewhere in the code, something was trusted that should have been verified.
WordPress gets the headlines because it runs a very large share of the world's websites, so a single flawed plugin can affect hundreds of thousands of sites at once. But the underlying issue is universal.
Shopify, Squarespace, Wix, Drupal, Joomla, Magento and every custom-built application are all made of code, and all of them have had vulnerabilities. The difference is where the responsibility sits. On a fully hosted platform like Shopify or Squarespace, the vendor patches their own core software, though any third-party app you install is still your exposure. On a self-hosted system, the responsibility for patching is yours - or your host's, if you have chosen a host that takes it on.
That distinction is the single most important thing for a small business owner to understand about website hosting for small business. It is not about which platform is "safer." It is about who is actually watching, and how quickly they act.
If you are running WordPress and are not certain when your plugins were last updated, our security audit and update service is built for exactly that situation.
Small business owners often assume they are too small to be a target. This misunderstands how attacks work. Nobody is sitting at a keyboard choosing your business. Automated scanners crawl the entire internet continuously, testing every site they find against a list of known flaws. Your site is not selected - it is simply found.
What happens next is rarely dramatic. Most compromised small business sites are not defaced. They are quietly used to send spam, to host scam pages under your domain name, to redirect your Google traffic to somewhere else, or to skim customer details from your checkout. The first sign is usually a Google warning on your search listing, a hosting suspension, or a customer asking why your site sent them somewhere strange. By then the damage to your reputation and rankings is already done.
The defence against all of this is unglamorous and entirely practical: keep everything updated, keep backups you have actually tested, and have somebody watching who understands what they are looking at.
This is exactly what managed web hosting is for. Rather than a server handed over to you with the maintenance left as your problem, managed hosting means the underlying software stack - the operating system, the web server, the PHP version, the firewall rules - is monitored and patched as part of the service. Vulnerability announcements are assessed as they are published, not whenever somebody remembers to check.
The value of expert website hosting support becomes obvious the moment something goes wrong. There is a real difference between a support ticket answered in four days by somebody reading a script, and a phone call answered by a person who can look at your actual server, read the actual log files, and tell you whether you have a problem. Australian web hosting with real support means you are talking to someone in your timezone who knows your setup, not queuing behind ten thousand other tickets.
If your customers are in Geelong, Ballarat, Bendigo or across regional Victoria, your website is often the first and only impression they get of your business. A site that has been flagged by Google as compromised, or that has been offline for two days while somebody untangles a break-in, costs you real enquiries from real people down the road.
Choosing Geelong web hosting from a provider who knows your business is not sentimentality. It means the person who answers the phone has context. It means server infrastructure located in Australia, which matters for both performance and for how your customer data is handled. And it means that when a significant vulnerability is announced, somebody has already checked whether it affects you before you have finished reading the news about it.
Regardless of who hosts your site, a few things are worth doing now. Confirm your website software, themes and plugins are on current versions. Remove anything installed that you no longer use, because unused code is still exploitable code. Check that backups are running and that somebody has actually restored one at least once to prove they work. Make sure administrator accounts use strong, unique passwords with two-factor authentication enabled. And find out, specifically, who is responsible for patching your site - if the answer is unclear, the answer is nobody.
None of this is difficult. It is simply a matter of it being somebody's job, done on a schedule, by someone who reads the vulnerability announcements as they are published rather than after something has gone wrong.
If you would rather updates and security monitoring were not your responsibility, that is exactly what our WordPress security audit and update packages are for. We check your site against known vulnerabilities, apply core, theme and plugin updates in a controlled way with backups taken first, and tell you plainly if we find something that needs attention. No call centre, no ticket queue - just people in Australia who know your setup.
Not sure where your site currently stands? Get in touch for a no-obligation review. We will look at what you are running, tell you what is out of date and what the actual risk is, and you can decide from there - whether or not you end up as a client.
