What hackers look for on small business websites in 2026

A field-guide to the most common attack vectors against SMB websites, what they cost when they succeed, and what continuous monitoring catches that point-in-time scans miss.

Small business websites are not low-priority targets. The 2025 Verizon Data Breach Investigations Report SMB snapshot shows that 88% of breaches at small businesses involve ransomware — against 39% at large enterprises — and the median ransom demand is $115,000. SMBs are not flying under the radar; they’re being attacked because they pay faster and defend slower.¹

This article walks through how attackers actually find and target small-business websites, the top ten things they check for in seconds, and what continuous monitoring catches that a point-in-time scan can’t.

Why are small businesses such common targets?

A few overlapping reasons, none of them comfortable:

They’re cheap to attack. Modern attackers don’t pick targets one at a time. They run automated scans across millions of IP addresses and domains, looking for known vulnerabilities. A business website running an out-of-date WordPress plugin shows up in those scan results alongside every other vulnerable site.
They pay faster. A bakery that lost its booking system over the weekend will pay $5,000 to get it back. A Fortune 500 has a security team, an incident-response retainer, and a legal department that says no.
The defences are weaker. Most SMBs have no security team. Patching is on a “when we remember” schedule. Monitoring is “the website looked fine yesterday”.
The trust is more valuable. Reputation is a bigger fraction of an SMB’s revenue than it is for a chain. One incident on the local news is a year of damage.

What are the top ten things hackers check for?

Here is what an automated scan against your site checks for in the first 60 seconds.

1. Open ports and exposed services. The scan looks for remote-access ports, file-transfer ports, database ports, internal admin panels — anything that should not be reachable from the open internet. A surprising number of small business sites have a database port wide open because somebody opened it for a one-off job in 2022.

2. Outdated content-management plugins. WordPress, Drupal, Joomla, Magento, Shopify, BigCommerce. Every one has a long history of vulnerable plugins. Modern scanners run 8,000+ checks that detect the exact version of the exact plugin you are running and tell you whether it is vulnerable.

3. Known security flaws in the website framework itself. Next.js, Laravel, Rails, Django, Express — every framework has had at least one critical security flaw in the last 12 months. A 2025 Next.js authorisation bypass is a recent example: any older version running its built-in login protection could be bypassed with a single hidden header. An automated scanner finds it in milliseconds.

4. Weak SSL/TLS encryption. Encryption standards from the 1990s and 2000s still enabled. Ciphers from 2010. Certificates issued by unfamiliar authorities. The scan grades your encryption the same way the public SSL graders do.

5. Exposed admin pages. /wp-admin, /admin, /login, /dashboard, /phpmyadmin. Reachable from the open internet, often with brute-force protection switched off, often with default-or-near-default passwords.

6. Database injection in form fields. Search boxes, login forms, contact forms — anything that takes user input and looks up data. Active scanners run thousands of test patterns automatically.

7. Script-injection openings. Any field where user input is shown back on the page without being escaped — comment forms, name fields, search results — can be a way to inject malicious scripts. Cookie theft and session hijacking start here.

8. Forgotten subdomains. dev., staging., old., events., 2021-promo. — all the subdomains a marketing campaign or developer set up and never took down. Often running unpatched code.

9. Weak or default credentials. Admin / admin. Admin / password. Admin / <companyname>123. The scan tries the top 1,000 default credential pairs against every login form it finds.

10. Accidental information leaks in server responses. Server headers that announce the exact version of the web server. Configuration pages left publicly accessible. Version-control directories exposed. Database error messages displayed to the visitor. Any one of these is a roadmap for the next stage of the attack.

That is the top ten. The full scan goes deeper.

How do continuous scans help?

Point-in-time scans — the free ones you run when you remember — tell you what was true at one moment. Continuous scans tell you what changed.

That is a big difference, because most attacks do not happen the day a security flaw is disclosed. They happen weeks later, when an attacker has had time to weaponise it and add it to their automated scan toolkit. The US government publishes around 130 new security flaws per day across all software in 2025.² Most do not matter to your specific stack. Some do. The ones that matter, you want to know about within hours of disclosure — not whenever you next remember to run a scan.

A continuous scanner like AuraWatch runs the full set of checks on your sites on a schedule — weekly on the free plan, daily on Starter, hourly on Pro, continuously on Enterprise. Every scan compares against the last one and surfaces what changed. A new port open? A newly published security flaw that matches your stack? A certificate about to expire? You hear about it the same day, in plain English, with the fix.

What can I do about all this without hiring a security team?

A short, realistic list:

Patch on a schedule. Every plugin, every theme, every CMS. 30-day window, 7-day window for security-flagged updates.
Run continuous scans. Free scanners give you a snapshot. Continuous monitoring tells you when something changes between snapshots, which is when most attacks become visible.
Long, unique passwords + 2FA on admins. Boring but effective.
Take the dev/staging subdomains down when you’re done with them. Or move them to an internal-only network. Forgotten subdomains are one of the most common entry points.
Configure browser-protection headers. A handful of small server settings (forced secure connections, script-source restrictions, frame-embedding limits). None of these are show-stoppers on their own; together they raise the bar.

How does AuraWatch help?

We run the same checks security professionals run, on a schedule, against your sites. Every finding comes with a plain-English explanation of what it is, why it matters, and how to fix it. Every plan includes your whole team — bring your developer, your IT support partner, your auditor. If a finding needs a security engineer to fix, the team behind AuraWatch (Elemental Concept) is one click away.

Try it free for one site — weekly scheduled scans, no card required.

Helpful follow-on reading:

Source: Verizon DBIR 2025 SMB snapshot. ↩
Source: NVD dashboard, NIST — 35,196 publicly catalogued security flaws in the first 9 months of 2025, around 130 per day. ↩