Most founders check their website once. They launch it, admire it, then forget it exists until something breaks.
That’s the problem. A website isn’t a brochure you print and forget. It’s software, sitting on the open internet, and software left unattended gets found by the wrong people eventually.
I’ve audited enough small business websites to see the same pattern repeat. The design’s fine. The copy’s fine. Underneath, the basics are missing.
Certificates lapse and nobody notices until a customer sees a warning screen instead of your homepage. Plugins and themes go months without an update, each missed patch a door left open a little wider. Contact forms collect names, emails, sometimes payment details, with no validation and no rate limiting, which makes them a magnet for bots and a liability the moment that data leaks. Admin logins sit on default usernames with passwords reused from somewhere else. Backups either don’t exist or nobody’s ever tested whether they actually restore.
None of this shows up when you glance at the website. It shows up when something goes wrong, and by then it’s expensive.
A breach costs more than the fix. It costs the conversation you have to have with every customer whose data was exposed. It costs the trust that took years to build. Google treats an insecure website differently too: browsers flag it, rankings drop, and the traffic you worked for stops arriving. In Nigeria, Kenya, South Africa and most markets I work in, data protection law (the NDPA, POPIA, the Kenya Data Protection Act) now carries real consequences for negligence. None of them care that you didn’t know your contact form was collecting data insecurely.
Fixing this isn’t complicated. It’s just not glamorous, so it gets skipped.
A working baseline looks like this:
- SSL renews automatically, and you get an alert if it ever fails.
- The CMS, plugins and any custom code get patched on a schedule, not “whenever there’s time.”
- Every form validates input and limits how often it can be submitted.
- Admin access uses unique logins and two-factor authentication.
- Backups run automatically and get tested, not just stored and forgotten.
- Someone, or something, is actually watching for unusual activity.
None of this needs a big budget. It needs someone who checks it deliberately, instead of assuming it’s fine because the website loads.
If you built your website once and haven’t looked under the bonnet since, that’s worth ten minutes of someone’s time to check. Cheaper than finding out the hard way.
