My WordPress site has not been updated in over a year. Is it actually at risk?

Yes, realistically. An out-of-date core, theme, or plugin sits under Security Misconfiguration and Software Supply Chain Failures, two of the highest-ranked categories in OWASP's current Top 10. A year of missed updates means a year of publicly documented, already-patched flaws left open on your site. Automated scanners look for exactly those known flaws, so the risk grows every month you leave it. Updating is the first thing to fix, before anything else on the list.

Why would anyone attack a small business website nobody visits?

Because nobody chose you. Most compromises start with automated scanning that sweeps large ranges of the internet looking for a specific software version with a known flaw. The scanner does not know or care what your company does, how much revenue you make, or how many visitors you get. It matches a version string and moves on. Traffic volume is not a defence, and being small is not a defence either. Software condition is what decides.

What is the single most common way small business websites get hacked?

There is no official ranking of causes for small business sites specifically. What we do have is OWASP's own testing data, which puts Broken Access Control first and Security Misconfiguration second in its 2025 Top 10. In plain terms, that is weak account and permission setups, plus outdated or badly configured software. Between them those two categories cover the large majority of neglected WordPress compromises we see, which is why the fixes below start there.

Is it usually my plugins or the WordPress core that is the problem?

Often the plugins. OWASP added a dedicated category in its 2025 edition, Software Supply Chain Failures, precisely because a flaw in a third-party component you installed is now as common a way in as a flaw in code your team wrote. Core updates tend to install automatically on modern setups. Plugins and themes are where the neglect collects, especially ones installed for a campaign years ago and never removed.

Can a contact form or file upload on my site really be a security hole?

Yes. OWASP documents unrestricted file upload as a real attack pattern in its own cheat sheet. A weak upload can let someone plant executable code, exhaust your storage, overwrite files, or turn your form into a phishing host. The mitigations are specific: allow-list the extensions you accept, check the actual file signature rather than trusting the browser's claimed type, rename files randomly, and store uploads outside the public webroot.

I use a simple admin password I have had for years. Does that matter?

It matters a lot. Weak or reused admin credentials fall under Authentication Failures in OWASP's list, and they are the reason automated login attempts are worth running at scale. NIST's current authentication guidance asks you to screen new passwords against lists of known-breached passwords rather than relying on complexity rules alone. A long unique password from a password manager, plus multi-factor authentication on the account, removes almost all of this risk for free.

Does changing my password every 90 days actually help?

No, not on its own. NIST's current guidance explicitly moved away from forced periodic password rotation, because it pushes people towards small predictable changes and written-down passwords. What matters more is length, screening against breached-password lists, and turning on multi-factor authentication. Force a change when you have actual evidence of compromise, or after any incident on the site, rather than on a calendar reminder that nobody takes seriously.

What is MFA and do I really need it on a small business website?

Multi-factor authentication asks for a second proof of identity beyond the password, such as an app-generated code, a hardware key, or a passkey. OWASP's own guidance cites Microsoft analysis that MFA blocks the large majority of account-takeover attempts. For a website admin login it is one of the highest-return, lowest-cost controls available, it is usually a free plugin or a built-in platform setting, and it takes an afternoon to roll out across your admin accounts.

Is SMS text-message login verification good enough?

It is much better than nothing, and if the choice is SMS or no second factor, turn on SMS today. But NIST classifies SMS as a restricted authenticator because of SIM-swap and interception risk, so it is the weakest of the common options. An authenticator app generating time-based codes, a hardware security key, or a passkey is the stronger choice wherever your CMS or hosting control panel supports it. Most modern platforms do.

Are security questions still an acceptable backup login method?

No. NIST's current standard no longer accepts security questions as a valid authentication factor, because the answers are often guessable, publicly discoverable, or shared on social media by the account holder without thinking about it. If your site still offers them as a password-recovery path, that path is weaker than the password itself. Replace it with email-based recovery on an account that itself has multi-factor authentication turned on.

What does a least-privilege admin account mean in practice for my site?

It means not everyone who touches the website needs full Administrator access. Give each person the role that matches what they actually do, such as Editor, Author, or Shop Manager, and reserve full Admin for the one or two people who genuinely need it. This is the practical application of OWASP's top category, Broken Access Control. It costs nothing and it caps the damage if any single account is taken over.

Should I use a password manager for site logins?

Yes. It is one of the cheapest and highest-return controls you can put in place, and it pairs directly with NIST's guidance against reused, short, or previously breached passwords. It also solves the practical problem behind most weak website passwords, which is that people reuse one they can remember across the CMS, the hosting panel, and the database. Reputable managers have free or low-cost tiers, so budget is not the obstacle.

I have backups. Does that mean I am covered?

Only if you have actually restored one. A backup you have never restored is an assumption, not a safety net. It might be capturing files but not the database, running against a stale directory, or silently failing. Google's own hacked-site recovery guidance treats restoring a backup as one step inside a longer process, not the whole fix. Book a practice restore to a staging environment, confirm the site actually comes back, then write down how long it took.

If my site gets hacked, can I just restore yesterday's backup and move on?

Not safely, and this is the most common expensive mistake. If the backup was taken after the attacker got in, you restore the attacker with it. Even a genuinely clean backup leaves the original hole open, so the same automated scan finds you again. Google's guidance is explicit: restore, then update everything, remove unused plugins and themes, fix the specific weakness that let them in, and rotate every credential tied to the site.

How often should a small business website be backed up?

There is no single official rule for a general business site. The practical pattern that works is a daily automated backup plus a manual one before every update or plugin change, stored off-site rather than on the same server as the site. Keeping backups off the live server matters because a compromise that reaches the filesystem can otherwise destroy your recovery option along with the site. Then test a restore on a schedule rather than assuming.

My site has a padlock icon. Does that mean it is secure?

It means the connection between the visitor's browser and your server is encrypted, and that whoever holds the certificate controls that domain. That is all. A domain-validated certificate says nothing about whether the organisation behind the site is legitimate, and nothing at all about whether the site's code has flaws in it. Phishing sites carry padlocks too. Treat the certificate as a requirement for the connection, not as evidence about the content.

Do I need to pay for an SSL certificate, or is a free one good enough?

A free certificate is fine for the large majority of business sites. Let's Encrypt is a nonprofit certificate authority issuing domain-validated certificates at no cost, with renewal automated by software on the server, and most hosts now offer it as a one-click option. It provides the same encryption and the same domain-control proof as a paid equivalent. Paid extended-validation certificates add an organisation identity check that mainly matters for banks and similar platforms.

What is mixed content and why does my browser warn about it?

Mixed content is an HTTPS page that still loads some resources over plain HTTP. Browsers block active resources such as scripts outright, and warn on passive ones such as images. It matters because anything loaded over plain HTTP can be modified in transit, which is a route to defacing part of the page or serving phishing content inside an otherwise trusted site. It usually appears after a migration where hardcoded HTTP URLs were left in content.

What is HSTS and should I turn it on?

HSTS is a response header that tells browsers to load your site only over HTTPS, even if a visitor types or clicks a plain HTTP link, and it removes the ability to click through certificate warnings. Mozilla's guidance recommends a minimum max-age of six months, with two years preferred. It is a one-time configuration change on the server. Enable it once you are sure every part of the site works over HTTPS, because it is deliberately hard to undo quickly.

What does a web application firewall do that my hosting does not?

A WAF filters incoming requests before they reach your site, blocking known attack patterns, common exploit attempts, and a lot of automated scanning traffic. Standard shared hosting generally does not include that layer. Cloudflare's free plan, priced at zero on its own plans page, includes a CDN, unmetered DDoS protection, and a free managed WAF ruleset. That makes a basic WAF one of the easiest layers to add without a budget conversation.

Do I need a WAF if my site is small and low-traffic?

Probably yes, because attackers target software rather than traffic. An outdated plugin gets found by automated scanning regardless of how many humans visit your site, so low traffic does not lower your exposure. A WAF will not fix an out-of-date plugin, and it should never be a substitute for updating, but it is a cheap layer that filters a lot of noise and buys you time between a flaw being published and you patching it.

What does website monitoring actually mean in practice?

It means ongoing scanning for changed files, malware signatures, and blocklist status, plus a human who actually reads the alerts. The second part is what most small businesses skip, because it is a recurring task rather than a one-time setup. This is why monitoring is usually bundled into a maintenance retainer rather than handled in-house. Vendor security platforms sell scanning on a schedule, but a scan nobody reads is not monitoring.

How do I know if my site has actually been hacked?

Google lists four signals: a direct notice from Google that your site is compromised, a warning shown against your listing in search results, pages or content on the site you did not create, and cloaked content that shows something different to search engines than it shows to you. Google Search Console's Security Issues report is the single most reliable place to check, and it is free to set up on any site you own.

My site looks fine to me. Could it still be compromised?

Yes, and this is common. Cloaked hacks deliberately serve a normal page to the site owner and to logged-in administrators, while serving spam, redirects, or phishing content to search engines and to visitors arriving from search. That is why owners often find out from a customer or from a Google warning rather than by looking. Checking Search Console, and fetching your own pages as a search-engine user agent, is far more reliable than eyeballing the homepage.

If I get hacked, what is the very first thing I should do?

Take the site offline before you touch anything else, so the malicious content stops reaching visitors while you work. Google's own guidance recommends serving an HTTP 503 status from outside the infected directories rather than relying on error pages or robots.txt. Then notify your hosting provider, because the server environment itself may be involved. Google also states that a brief period offline during cleanup is not expected to hurt your future search ranking.

What is the difference between cleaning a hacked site and rebuilding it?

Cleaning removes the malicious files and content, then closes the specific weakness that allowed entry. Rebuilding starts fresh. In practice the gap is smaller than it sounds, because Google's own recovery guidance recommends a clean install of the CMS and server software rather than an in-place upgrade, on the grounds that upgrades can leave infected legacy files behind. A properly done clean already resembles a partial rebuild, which is why quotes for it vary.

After a hack, is changing my WordPress admin password enough?

No. Every credential tied to the site should be rotated: hosting control panel, FTP or SFTP, the database user, every CMS account, and any API keys the site uses. Google's guidance repeats this at both the quarantine stage and the cleanup stage. Attackers routinely create extra accounts or leave a second way in, so changing only the one login you think was used leaves the door you have not found still open.

Roughly what does it cost to clean up a hacked WordPress site in the UAE?

Our published figure for a cleanup is AED 1,500 to 6,000, plus roughly 24 to 72 hours of downtime while the work happens. That is our own pricing rather than a market survey. The range moves with how much content the site has, whether a clean backup exists, and whether customer data was involved, since a data question adds review work beyond the technical cleanup. Final pricing depends on scope.

Google is showing a warning on my search listing. How do I get it removed?

Fix every instance of the hacked content across the whole site, not only the pages you already know about, then request a review through Search Console's Security Issues report. The request has to describe the problem and the exact steps you took. Google states plainly that fixing the issue on only some pages will not earn a partial return to search results, so a partial cleanup wastes the review cycle entirely.

How long does it take Google to clear a hacked-site warning?

Google does not publish a fixed number, and you should be sceptical of any source that gives you one in hours. Its own documentation says malware reviews typically take a few days, while a hacked-site review may require up to several weeks because a person has to investigate. After approval, the warning itself clears within a few days as the change propagates through Safe Browsing, Chrome, and Search Console.

Can I get flagged again right after being cleared?

Yes, if the pattern repeats, and Google has a specific policy for it. A site that swings between compliant and non-compliant repeatedly within a short window can be classified a Repeat Offender. The owner is notified at the Search Console email on file, and the site loses the ability to request further reviews through Search Console for 30 days. That is the practical penalty for cleaning symptoms without closing the underlying hole.

If my website is hacked and customer data is exposed, must I report it in the UAE?

In principle yes. The federal Personal Data Protection Law requires organisations that process personal data to secure it and to notify when a breach puts that data at risk. The published federal text uses the word immediately rather than a fixed number of hours, and no fine schedule has been published because the Executive Regulations are still pending. Treat any source quoting an exact federal deadline or dirham figure with caution, and take proper legal advice.

Does the UAE have a specific cybersecurity law for business websites?

There is no single law aimed at business websites in particular. The PDPL, Federal Decree-Law No. 45 of 2021, governs how you handle personal data, which includes anything your website collects. The UAE Cyber Security Council is the national authority and publishes standards and guidance, though its published framing is built around protecting critical national infrastructure rather than setting a blanket requirement for an ordinary SME website.

Is my company in DIFC or ADGM subject to different breach rules?

Yes. DIFC and ADGM each run their own data protection law and their own regulator, separate from the federal PDPL, and each publishes its own penalty figures. Those numbers apply only to companies licensed inside those zones. A mainland or standard free-zone company follows the federal PDPL instead, which has no published fine schedule yet. Do not apply a DIFC or ADGM number to a mainland business, and check your own licence.

How is website hardening different from a penetration test?

Hardening is preventive work you commission before anything goes wrong: updates, MFA, an access review, a WAF, and a tested backup. A penetration test is an adversarial exercise where skilled people actively try to break into your live systems and prove what an attacker could reach. They answer different questions and sit at very different price points. An automated scan or a WAF subscription is not a penetration test and should never be sold as one.

What is the first thing to fix on a neglected WordPress site?

Update the core, every plugin, and every theme, and delete anything you no longer use. That single pass closes the largest share of publicly documented, easily exploited flaws, because automated scanning is looking for exactly those known versions. Take a backup first, and update on a staging copy if the site is business-critical. Then turn on multi-factor authentication for every administrator account, which is the next-highest return for the effort involved.

Cyber SecurityAugust 7, 2026

Website Security for UAE Businesses: How to Protect a Site Nobody Has Updated in a Year

SKIMBOX Team

Almost nothing that compromises a small business website is a targeted attack. It is an automated scanner finding an out-of-date plugin. Here is what actually gets sites in, the controls that pay back most, what you can do yourself, and what it costs in the UAE.

Nobody chose your website. That is the part most owners get wrong, and getting it wrong is what keeps a neglected site neglected.

"We are too small to be a target" assumes a person sat down, looked at your business, and decided you were worth attacking. That is not what happens to small business websites. What happens is automated scanning. Software sweeps the internet, checks what version of a plugin or content management system each site runs, matches it against a public list of known flaws, and exploits whatever matches. It does not know what your company does. It does not care that you get forty visitors a day. It matched a version string.

This guide is about the website specifically. Our cybersecurity guide for small businesses in the UAE covers the whole business, and our penetration testing and VAPT guide covers commissioned adversarial testing. This one covers the site you have not logged into since last year.

What actually gets websites compromised

The reference point worth anchoring to is the OWASP Top 10, the standard classification of weaknesses exploited in real applications. The current released edition is the 2025 edition, the eighth, built on a data window running from 2021 to 2025 [1]. Two things in it speak directly to a neglected site.

Security Misconfiguration is now second on the list. In the previous edition it sat fifth. This is the category covering outdated software left running, default settings never changed, and admin paths left exposed. A site nobody has updated in a year falls into it by definition [1].

Software Supply Chain Failures is a new category, ranked third. It replaced the older "vulnerable and outdated components" framing, and exists because so many compromises now start in a third-party component the business installed rather than in code the business wrote [1]. For a WordPress site, that is plugins and themes. A gallery plugin installed for a campaign in 2023 and forgotten is a risk, not a decoration.

The rest is familiar. Weak or reused admin passwords fall under Authentication Failures [1]. Overly broad admin access falls under Broken Access Control, ranked first [1]. And an unrestricted file upload, common on contact and careers forms, is a documented attack path with documented fixes: allow-list extensions, verify the actual file signature rather than the browser's claimed type, and store uploads outside the public webroot [2].

None of that requires anyone to have picked you.

The controls that pay back most, in order

No official body ranks website controls by return for a small business, so what follows is a synthesis of what NIST, CIS, and OWASP each treat as foundational, ordered by what we see change outcomes most.

1. Updates and patching

First by a wide margin. Every hour a publicly documented flaw sits unpatched is an hour automated scanning can find it. NIST's patch management guidance frames patching as preventive maintenance and as a cost of doing business, and asks for risk-based prioritisation rather than patching everything on one schedule [5]. Note what it does not do: it sets no fixed day-count deadline for private businesses. Any source telling a UAE SME to patch within a specific number of days is quoting a rule written for somebody else.

In practice: back up first, update on a staging copy if the site matters to revenue, update the core, then every plugin, then every theme, and delete everything you no longer use. Deleting an unused plugin is a security fix, because a deactivated plugin still has files on the server.

Can you do this yourself? Yes. This is discipline, not expertise. The only case for help is a site so far behind that updates break it, a real risk after a year and the reason people put it off.

2. Strong authentication with multi-factor

Second, and also free. OWASP cites Microsoft's own analysis that multi-factor authentication would stop the large majority of account compromise attempts, and recommends app-based codes, hardware keys, or passkeys over SMS one-time codes [3]. NIST designates SMS a restricted authenticator because of SIM-swap and interception risk [4].

The same NIST guidance retired two habits worth dropping: forced periodic password rotation, and security questions as an authentication factor. It asks instead for length and screening against known-breached lists [4]. A password manager does that for you.

Can you do this yourself? Yes. MFA on a CMS is usually a plugin or a built-in setting, and rolling it out across your admins is an afternoon.

3. Least-privilege admin accounts

Broken Access Control is the top category in OWASP's 2025 data [1], and on a small business website it looks the same every time: everyone who ever touched the site has an Administrator account, including the agency that rebuilt it two years ago and the intern who left.

Give each person the role matching what they actually do, reserve full admin for one or two people, and remove accounts for anyone no longer working on the site. This does not stop a compromise, it caps one, which is a different and underrated value.

Can you do this yourself? Mostly. Any admin who understands the CMS role system can do the review. The judgement call is which custom roles a plugin quietly added.

4. Backups you have actually restored

A backup you have never restored is an assumption. Google's recovery documentation splits recovery three ways depending on whether you have a current clean backup, an old clean backup, or none at all [12]. That only helps if you know which one you are in, and most owners find out at the worst moment.

Backups should run daily, live off the server they are backing up, and get restored to staging on a schedule so you know they work and how long it takes.

Can you do this yourself? Partly. Setting up backups is a plugin or a hosting toggle. A genuine restore test is where most people need someone who has done it before, and it is exactly the step people skip.

After those four

HTTPS everywhere. A certificate proves the connection is encrypted and that whoever holds it controls the domain. It does not vouch for the site's content or the business behind it [8]. Free automated certificates are the norm rather than a shortcut: Let's Encrypt is a nonprofit certificate authority issuing domain-validated certificates, with renewal handled on the server [9]. Check two details: mixed content, where an HTTPS page still loads scripts or images over plain HTTP, and HSTS, a header forcing HTTPS that also blocks click-through on certificate warnings [8].

A web application firewall. It filters malicious requests before they reach your site. It is a layer, not a fix, and it will not save an out-of-date plugin. Cloudflare's free plan includes a CDN, unmetered DDoS protection, and a free managed WAF ruleset [18].

Monitoring. File-change and malware scanning, plus somebody who reads the alerts. CIS publishes Implementation Group 1, its essential cyber hygiene tier, for smaller organisations with limited security expertise [6], and NIST publishes a small business quick start guide [7]. Both are sane checklists. Monitoring is what small businesses most often skip, because it is recurring work rather than a one-time setup, which is why it usually lands in a maintenance retainer.

Why we are not quoting the scary statistics

You will have seen the numbers. So many websites hacked every day. Some percentage of small businesses that close within months of a breach. We went looking for the primary sources and could not trace them to a government body, a standards organisation, or a platform's own documentation. They circulate through vendor marketing until they read as fact.

We are leaving them out rather than softening them, because an argument resting on an unverifiable number is weaker than the mechanical truth: scanning is constant, it finds known flaws, and your out-of-date plugin is a known flaw.

How to tell if your site is already compromised

Google lists four signals: a direct notice from Google, a warning against your search listing, pages or content you did not create, and cloaked content, shown to search engines but hidden from you as the owner [10]. That last one is why sites stay compromised for months. The hack serves a normal page to logged-in admins and spam or redirects to everyone else.

The hacked content itself takes one of four shapes: code injected into existing pages, new spam or phishing pages, existing pages altered with hidden links, or conditional redirects firing for some visitors and not others [13]. Search Console's Security Issues report is more reliable than looking at your own homepage. Set it up before you need it.

What to do if it has already happened

Google publishes a good recovery sequence. Follow it in order.

Quarantine. Take the site fully offline, serving an HTTP 503 status from outside the infected directories rather than relying on error pages or robots.txt. Notify your host, since the server environment may be involved. Review every account tied to the site, remove any the attacker created, and reset every password: hosting, FTP, database, CMS [11]. Google states that a brief period offline during recovery is not expected to hurt future search ranking [11].
Assess. Compile every file and URL that changed, ideally by comparing the live site against a known-clean backup [12].
Clean or rebuild. With a current clean backup, restore it, then apply every update, remove unused plugins and themes, fix the weakness that allowed entry, and change all passwords again. With only an old backup, image the infected site for reference, restore the old one, upgrade everything, then compare the two to bring back legitimate content selectively. With no backup, copy the infected site, clean the copy by hand, and restore service from that. In all three cases Google recommends a clean install rather than an in-place upgrade, because upgrades can leave infected legacy files behind [12].
Confirm before declaring it done. Has exposed user data been addressed, with the regulatory implications considered rather than just the technical fix? Is the software current? Are unnecessary plugins gone? Is the root weakness closed? Is there a maintenance plan [12]?

Step three is where the expensive mistake lives. Restoring a backup is step one, not the fix. If it was taken after the attacker got in, you restore the attacker. If it was taken before but you do not close the weakness, the same scanner finds you again within days.

To get a Google warning lifted, fix every instance across the whole site, then request a review through Search Console describing the problem and the exact steps taken. Google states that fixing the issue on only some pages will not earn a partial return to search results [14]. Reviews are manual, and Google's language on timing is deliberately unfixed: malware reviews typically take a few days, hacked-site reviews may require up to several weeks, and the warning clears within a few days after approval [14]. Ignore any source quoting an exact hour count. And a site cleaned, re-flagged, and cleaned again within a short window can be classified a Repeat Offender, losing the ability to request further reviews for 30 days [15].

The UAE angle

If a compromised website exposes customer personal data, you are in scope of the federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, which requires organisations processing personal data to secure it [16].

Be careful with what you read about deadlines and fines. The published federal law uses the word immediately for breach reporting rather than a fixed number of hours, and no fine schedule has been published, because the Executive Regulations are still pending. Sources quoting a precise federal deadline or a dirham penalty are filling that gap with something. DIFC and ADGM each run their own law, regulator, and published penalty figures, and those apply only to companies licensed in those zones. They are not the federal position. Our PDPL compliance guide has the detail, and for anything specific to your licence you want a qualified lawyer rather than an article.

The UAE also has a Cyber Security Council as the national authority, and it publishes standards at its own site [17]. Its mandate centres on protecting critical national infrastructure rather than imposing a blanket requirement on an ordinary SME website, so treat any claim that your brochure site is legally bound by a national assurance standard sceptically.

What website security costs

Item	Cost	Type
Updates, MFA, password manager, least-privilege review	Free	Discipline
Let's Encrypt certificate [9]	Free	Ongoing
Cloudflare free plan, CDN + DDoS + managed WAF ruleset [18]	USD 0 a month	Ongoing
Cloudflare Pro, billed annually [18]	USD 20 a month	Ongoing
Sucuri Security Platform, Basic tier [19]	USD 229 a year	Ongoing
Website maintenance, patching + SSL + backups [20]	From around AED 150 a month	Ongoing
Website hardening review [20]	From around AED 2,500	One-off
Professional security assessment [20]	From around AED 5,000	One-off
Hacked site cleanup [20]	AED 1,500 to 6,000 plus 24 to 72 hours of downtime	One-off

Three need explaining, because buying the wrong one is common.

A hardening review, from around AED 2,500, is the cheapest paid option and the right one for a neglected site. It is preventive: bring everything current, turn on MFA, clean up admin accounts, put a WAF in front, set up backups and run a real restore test.

A security assessment sits above it, from around AED 5,000, covering your setup rather than just the website. Our cybersecurity guide covers what that includes.

A penetration test is a different service again, and considerably more, because it is manual adversarial work against your live systems. Our penetration testing guide has the figures. A WAF subscription or an automated scan is not a penetration test, whatever the invoice says.

Ongoing patching is cheapest inside a maintenance plan, priced in our website maintenance and AMC guide from around AED 150 a month, and the cleanup figure comes from our real cost of running a website guide. Your host matters too, since backup tooling varies, which our UAE web hosting guide covers. If the site is one of several systems, our managed IT support and business continuity guides are the wider view. Final pricing depends on scope.

Real client stories

Anonymised situations from work we have done.

The backup that put the hack back. A retailer found spam pages under their domain, restored the previous night's backup themselves, and watched the pages return within two days. The backup had been taken after the compromise, and nothing had closed the vulnerable plugin. We cleaned from an older image, reinstalled fresh, patched everything, and rotated every credential. The restore was not wrong, it just was not the fix, and doing it first cost a second outage.

Eleven administrators, one of them gone. A services firm had eleven Administrator accounts on a site five people used. One belonged to a contractor who had finished eighteen months earlier and reused the password elsewhere. Nothing had happened yet. We cut it to two admins, gave everyone else appropriate roles, and turned on MFA. Free, in under two hours.

The plugin nobody remembered installing. A clinic's site was flagged in search results. The way in was a slider plugin from a redesign four years earlier, deactivated but never deleted, still on the server with a documented flaw. Deactivating is not deleting. After cleanup, removing unused components became a standing item, the boring fix that would have prevented it.

How SKIMBOX approaches website security

We work the order above, because that is where the return is and the first three cost nothing but attention. We bring the site current, turn on multi-factor authentication, cut admin accounts back to who needs them, put backups in place and restore one to prove they work, then add a WAF and monitoring where they earn their keep. We will say honestly when a hardening review is all you need and when you should buy something deeper.

A hardening review starts from around AED 2,500, a broader security assessment from around AED 5,000, and ongoing patching sits inside maintenance from around AED 150 a month. Cleaning up a site already compromised runs AED 1,500 to 6,000 plus 24 to 72 hours of downtime. Final pricing depends on scope.

See our cybersecurity services and web development services, or contact us for a straight look at the site you have been meaning to update.

References

[1] OWASP - Top 10:2025, the current released edition, including Broken Access Control at A01, Security Misconfiguration at A02, and the new Software Supply Chain Failures category at A03. owasp.org/Top10/2025/0x00_2025-Introduction

[2] OWASP - File Upload Cheat Sheet, risks of unrestricted file upload and recommended mitigations. cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

[3] OWASP - Multifactor Authentication Cheat Sheet, factor strength and implementation guidance. cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html

[4] NIST - Special Publication 800-63B, Digital Identity Guidelines, on authenticators, breached-password screening, SMS as a restricted authenticator, and periodic rotation. pages.nist.gov/800-63-3/sp800-63b.html

[5] NIST - Special Publication 800-40 Revision 4, Guide to Enterprise Patch Management Planning. csrc.nist.gov/pubs/sp/800/40/r4/final

[6] CIS - Critical Security Controls, Implementation Group 1, essential cyber hygiene for small and medium organisations. cisecurity.org/controls/implementation-groups/ig1

[7] NIST - Cybersecurity Framework 2.0 Small Business Quick Start Guide, SP 1300. nist.gov/publications/nist-cybersecurity-framework-20-small-business-quick-start-guide

[8] MDN Web Docs, Mozilla - Transport Layer Security practical implementation guide, covering what a certificate proves, mixed content, and HSTS. developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/TLS

[9] Let's Encrypt - About, a free, automated, nonprofit certificate authority operated by the Internet Security Research Group. letsencrypt.org/about

[10] web.dev, Google - How do I know if my site was hacked. web.dev/articles/how-do-i-know-if-my-site-was-hacked

[11] web.dev, Google - Quarantine your site. web.dev/articles/quarantine-your-site

[12] web.dev, Google - Clean and maintain your site, including the three backup scenarios and the clean-install recommendation. web.dev/articles/clean-and-maintain-your-site

[13] Google Search Central - What is hacked content, covering code, page, and content injection and conditional redirects. developers.google.com/search/docs/monitor-debug/security/what-is-hacked

[14] Google Search Console Help - Security Issues report and requesting a review, including review timeframes. support.google.com/webmasters/answer/9044101

[15] Google Search Central - Safe Browsing Repeat Offenders policy, including the 30-day restriction on further review requests. developers.google.com/search/docs/monitor-debug/security/safe-browsing-repeat-offenders

[16] The United Arab Emirates Government portal - Data protection laws, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. u.ae/en/about-the-uae/digital-uae/data/data-protection-laws

[17] The United Arab Emirates Government portal - UAE Cybersecurity Council, its mandate and the standards it publishes at csc.gov.ae. u.ae/en/information-and-services/justice-safety-and-the-law/cyber-safety-and-digital-security/uae-cybersecurity-council

[18] Cloudflare - Plans and pricing, including the free plan with CDN, unmetered DDoS protection, and a free managed WAF ruleset, and the Pro plan. cloudflare.com/plans

[19] Sucuri - Signup and pricing for the Security Platform tiers. sucuri.net/signup

[20] SKIMBOX - Our own pricing for website hardening reviews, security assessments, maintenance, and hacked-site cleanup, 2026. skimbox.co

Frequently asked questions

My WordPress site has not been updated in over a year. Is it actually at risk?
Yes, realistically. An out-of-date core, theme, or plugin sits under Security Misconfiguration and Software Supply Chain Failures, two of the highest-ranked categories in OWASP's current Top 10. A year of missed updates means a year of publicly documented, already-patched flaws left open on your site. Automated scanners look for exactly those known flaws, so the risk grows every month you leave it. Updating is the first thing to fix, before anything else on the list.
Why would anyone attack a small business website nobody visits?
Because nobody chose you. Most compromises start with automated scanning that sweeps large ranges of the internet looking for a specific software version with a known flaw. The scanner does not know or care what your company does, how much revenue you make, or how many visitors you get. It matches a version string and moves on. Traffic volume is not a defence, and being small is not a defence either. Software condition is what decides.
What is the single most common way small business websites get hacked?
There is no official ranking of causes for small business sites specifically. What we do have is OWASP's own testing data, which puts Broken Access Control first and Security Misconfiguration second in its 2025 Top 10. In plain terms, that is weak account and permission setups, plus outdated or badly configured software. Between them those two categories cover the large majority of neglected WordPress compromises we see, which is why the fixes below start there.
Is it usually my plugins or the WordPress core that is the problem?
Often the plugins. OWASP added a dedicated category in its 2025 edition, Software Supply Chain Failures, precisely because a flaw in a third-party component you installed is now as common a way in as a flaw in code your team wrote. Core updates tend to install automatically on modern setups. Plugins and themes are where the neglect collects, especially ones installed for a campaign years ago and never removed.
Can a contact form or file upload on my site really be a security hole?
Yes. OWASP documents unrestricted file upload as a real attack pattern in its own cheat sheet. A weak upload can let someone plant executable code, exhaust your storage, overwrite files, or turn your form into a phishing host. The mitigations are specific: allow-list the extensions you accept, check the actual file signature rather than trusting the browser's claimed type, rename files randomly, and store uploads outside the public webroot.
I use a simple admin password I have had for years. Does that matter?
It matters a lot. Weak or reused admin credentials fall under Authentication Failures in OWASP's list, and they are the reason automated login attempts are worth running at scale. NIST's current authentication guidance asks you to screen new passwords against lists of known-breached passwords rather than relying on complexity rules alone. A long unique password from a password manager, plus multi-factor authentication on the account, removes almost all of this risk for free.
Does changing my password every 90 days actually help?
No, not on its own. NIST's current guidance explicitly moved away from forced periodic password rotation, because it pushes people towards small predictable changes and written-down passwords. What matters more is length, screening against breached-password lists, and turning on multi-factor authentication. Force a change when you have actual evidence of compromise, or after any incident on the site, rather than on a calendar reminder that nobody takes seriously.
What is MFA and do I really need it on a small business website?
Multi-factor authentication asks for a second proof of identity beyond the password, such as an app-generated code, a hardware key, or a passkey. OWASP's own guidance cites Microsoft analysis that MFA blocks the large majority of account-takeover attempts. For a website admin login it is one of the highest-return, lowest-cost controls available, it is usually a free plugin or a built-in platform setting, and it takes an afternoon to roll out across your admin accounts.
Is SMS text-message login verification good enough?
It is much better than nothing, and if the choice is SMS or no second factor, turn on SMS today. But NIST classifies SMS as a restricted authenticator because of SIM-swap and interception risk, so it is the weakest of the common options. An authenticator app generating time-based codes, a hardware security key, or a passkey is the stronger choice wherever your CMS or hosting control panel supports it. Most modern platforms do.
Are security questions still an acceptable backup login method?
No. NIST's current standard no longer accepts security questions as a valid authentication factor, because the answers are often guessable, publicly discoverable, or shared on social media by the account holder without thinking about it. If your site still offers them as a password-recovery path, that path is weaker than the password itself. Replace it with email-based recovery on an account that itself has multi-factor authentication turned on.
What does a least-privilege admin account mean in practice for my site?
It means not everyone who touches the website needs full Administrator access. Give each person the role that matches what they actually do, such as Editor, Author, or Shop Manager, and reserve full Admin for the one or two people who genuinely need it. This is the practical application of OWASP's top category, Broken Access Control. It costs nothing and it caps the damage if any single account is taken over.
Should I use a password manager for site logins?
Yes. It is one of the cheapest and highest-return controls you can put in place, and it pairs directly with NIST's guidance against reused, short, or previously breached passwords. It also solves the practical problem behind most weak website passwords, which is that people reuse one they can remember across the CMS, the hosting panel, and the database. Reputable managers have free or low-cost tiers, so budget is not the obstacle.
I have backups. Does that mean I am covered?
Only if you have actually restored one. A backup you have never restored is an assumption, not a safety net. It might be capturing files but not the database, running against a stale directory, or silently failing. Google's own hacked-site recovery guidance treats restoring a backup as one step inside a longer process, not the whole fix. Book a practice restore to a staging environment, confirm the site actually comes back, then write down how long it took.
If my site gets hacked, can I just restore yesterday's backup and move on?
Not safely, and this is the most common expensive mistake. If the backup was taken after the attacker got in, you restore the attacker with it. Even a genuinely clean backup leaves the original hole open, so the same automated scan finds you again. Google's guidance is explicit: restore, then update everything, remove unused plugins and themes, fix the specific weakness that let them in, and rotate every credential tied to the site.
How often should a small business website be backed up?
There is no single official rule for a general business site. The practical pattern that works is a daily automated backup plus a manual one before every update or plugin change, stored off-site rather than on the same server as the site. Keeping backups off the live server matters because a compromise that reaches the filesystem can otherwise destroy your recovery option along with the site. Then test a restore on a schedule rather than assuming.
My site has a padlock icon. Does that mean it is secure?
It means the connection between the visitor's browser and your server is encrypted, and that whoever holds the certificate controls that domain. That is all. A domain-validated certificate says nothing about whether the organisation behind the site is legitimate, and nothing at all about whether the site's code has flaws in it. Phishing sites carry padlocks too. Treat the certificate as a requirement for the connection, not as evidence about the content.
Do I need to pay for an SSL certificate, or is a free one good enough?
A free certificate is fine for the large majority of business sites. Let's Encrypt is a nonprofit certificate authority issuing domain-validated certificates at no cost, with renewal automated by software on the server, and most hosts now offer it as a one-click option. It provides the same encryption and the same domain-control proof as a paid equivalent. Paid extended-validation certificates add an organisation identity check that mainly matters for banks and similar platforms.
What is mixed content and why does my browser warn about it?
Mixed content is an HTTPS page that still loads some resources over plain HTTP. Browsers block active resources such as scripts outright, and warn on passive ones such as images. It matters because anything loaded over plain HTTP can be modified in transit, which is a route to defacing part of the page or serving phishing content inside an otherwise trusted site. It usually appears after a migration where hardcoded HTTP URLs were left in content.
What is HSTS and should I turn it on?
HSTS is a response header that tells browsers to load your site only over HTTPS, even if a visitor types or clicks a plain HTTP link, and it removes the ability to click through certificate warnings. Mozilla's guidance recommends a minimum max-age of six months, with two years preferred. It is a one-time configuration change on the server. Enable it once you are sure every part of the site works over HTTPS, because it is deliberately hard to undo quickly.
What does a web application firewall do that my hosting does not?
A WAF filters incoming requests before they reach your site, blocking known attack patterns, common exploit attempts, and a lot of automated scanning traffic. Standard shared hosting generally does not include that layer. Cloudflare's free plan, priced at zero on its own plans page, includes a CDN, unmetered DDoS protection, and a free managed WAF ruleset. That makes a basic WAF one of the easiest layers to add without a budget conversation.
Do I need a WAF if my site is small and low-traffic?
Probably yes, because attackers target software rather than traffic. An outdated plugin gets found by automated scanning regardless of how many humans visit your site, so low traffic does not lower your exposure. A WAF will not fix an out-of-date plugin, and it should never be a substitute for updating, but it is a cheap layer that filters a lot of noise and buys you time between a flaw being published and you patching it.
What does website monitoring actually mean in practice?
It means ongoing scanning for changed files, malware signatures, and blocklist status, plus a human who actually reads the alerts. The second part is what most small businesses skip, because it is a recurring task rather than a one-time setup. This is why monitoring is usually bundled into a maintenance retainer rather than handled in-house. Vendor security platforms sell scanning on a schedule, but a scan nobody reads is not monitoring.
How do I know if my site has actually been hacked?
Google lists four signals: a direct notice from Google that your site is compromised, a warning shown against your listing in search results, pages or content on the site you did not create, and cloaked content that shows something different to search engines than it shows to you. Google Search Console's Security Issues report is the single most reliable place to check, and it is free to set up on any site you own.
My site looks fine to me. Could it still be compromised?
Yes, and this is common. Cloaked hacks deliberately serve a normal page to the site owner and to logged-in administrators, while serving spam, redirects, or phishing content to search engines and to visitors arriving from search. That is why owners often find out from a customer or from a Google warning rather than by looking. Checking Search Console, and fetching your own pages as a search-engine user agent, is far more reliable than eyeballing the homepage.
If I get hacked, what is the very first thing I should do?
Take the site offline before you touch anything else, so the malicious content stops reaching visitors while you work. Google's own guidance recommends serving an HTTP 503 status from outside the infected directories rather than relying on error pages or robots.txt. Then notify your hosting provider, because the server environment itself may be involved. Google also states that a brief period offline during cleanup is not expected to hurt your future search ranking.
What is the difference between cleaning a hacked site and rebuilding it?
Cleaning removes the malicious files and content, then closes the specific weakness that allowed entry. Rebuilding starts fresh. In practice the gap is smaller than it sounds, because Google's own recovery guidance recommends a clean install of the CMS and server software rather than an in-place upgrade, on the grounds that upgrades can leave infected legacy files behind. A properly done clean already resembles a partial rebuild, which is why quotes for it vary.
After a hack, is changing my WordPress admin password enough?
No. Every credential tied to the site should be rotated: hosting control panel, FTP or SFTP, the database user, every CMS account, and any API keys the site uses. Google's guidance repeats this at both the quarantine stage and the cleanup stage. Attackers routinely create extra accounts or leave a second way in, so changing only the one login you think was used leaves the door you have not found still open.
Roughly what does it cost to clean up a hacked WordPress site in the UAE?
Our published figure for a cleanup is AED 1,500 to 6,000, plus roughly 24 to 72 hours of downtime while the work happens. That is our own pricing rather than a market survey. The range moves with how much content the site has, whether a clean backup exists, and whether customer data was involved, since a data question adds review work beyond the technical cleanup. Final pricing depends on scope.
Google is showing a warning on my search listing. How do I get it removed?
Fix every instance of the hacked content across the whole site, not only the pages you already know about, then request a review through Search Console's Security Issues report. The request has to describe the problem and the exact steps you took. Google states plainly that fixing the issue on only some pages will not earn a partial return to search results, so a partial cleanup wastes the review cycle entirely.
How long does it take Google to clear a hacked-site warning?
Google does not publish a fixed number, and you should be sceptical of any source that gives you one in hours. Its own documentation says malware reviews typically take a few days, while a hacked-site review may require up to several weeks because a person has to investigate. After approval, the warning itself clears within a few days as the change propagates through Safe Browsing, Chrome, and Search Console.
Can I get flagged again right after being cleared?
Yes, if the pattern repeats, and Google has a specific policy for it. A site that swings between compliant and non-compliant repeatedly within a short window can be classified a Repeat Offender. The owner is notified at the Search Console email on file, and the site loses the ability to request further reviews through Search Console for 30 days. That is the practical penalty for cleaning symptoms without closing the underlying hole.
If my website is hacked and customer data is exposed, must I report it in the UAE?
In principle yes. The federal Personal Data Protection Law requires organisations that process personal data to secure it and to notify when a breach puts that data at risk. The published federal text uses the word immediately rather than a fixed number of hours, and no fine schedule has been published because the Executive Regulations are still pending. Treat any source quoting an exact federal deadline or dirham figure with caution, and take proper legal advice.
Does the UAE have a specific cybersecurity law for business websites?
There is no single law aimed at business websites in particular. The PDPL, Federal Decree-Law No. 45 of 2021, governs how you handle personal data, which includes anything your website collects. The UAE Cyber Security Council is the national authority and publishes standards and guidance, though its published framing is built around protecting critical national infrastructure rather than setting a blanket requirement for an ordinary SME website.
Is my company in DIFC or ADGM subject to different breach rules?
Yes. DIFC and ADGM each run their own data protection law and their own regulator, separate from the federal PDPL, and each publishes its own penalty figures. Those numbers apply only to companies licensed inside those zones. A mainland or standard free-zone company follows the federal PDPL instead, which has no published fine schedule yet. Do not apply a DIFC or ADGM number to a mainland business, and check your own licence.
How is website hardening different from a penetration test?
Hardening is preventive work you commission before anything goes wrong: updates, MFA, an access review, a WAF, and a tested backup. A penetration test is an adversarial exercise where skilled people actively try to break into your live systems and prove what an attacker could reach. They answer different questions and sit at very different price points. An automated scan or a WAF subscription is not a penetration test and should never be sold as one.
What is the first thing to fix on a neglected WordPress site?
Update the core, every plugin, and every theme, and delete anything you no longer use. That single pass closes the largest share of publicly documented, easily exploited flaws, because automated scanning is looking for exactly those known versions. Take a backup first, and update on a staging copy if the site is business-critical. Then turn on multi-factor authentication for every administrator account, which is the next-highest return for the effort involved.

SKIMBOX Team

Tech Consultancy

Want us to build something?

We work with teams across MENA, UK, USA, and India to build products, run programs, and grow.

Get in touch

Continue reading

ISO 27001 Certification in the UAE (2026): The Real Cost, the Process, and the Accreditation Trap

Jun 27, 2026Blogs

Penetration Testing and VAPT in Dubai (2026): Cost, Compliance, and How to Avoid a Scan Sold as a Pentest

Jun 26, 2026Blogs

Business Continuity and Disaster Recovery in the UAE: A Practical Guide

Aug 7, 2026Blogs

Website Security for UAE Businesses: How to Protect a Site Nobody Has Updated in a Year

What actually gets websites compromised