Most small business sites fail the same seven security checks, from missing headers to a PHP version nobody has looked at. None need a security team, and each one runs from a terminal. Here are the commands and configs, in order.
Most founders check their website once. They launch it, admire it, then forget it exists until something breaks.
That’s the problem. A website isn’t a brochure you print and forget. It’s software, sitting on the open internet, and software left unattended gets found by the wrong people eventually.
I’ve audited
A client’s WordPress site had quietly published over 30,000 spam posts, 600 more arriving every day, and he hadn’t written a single one. Here’s how I cleaned it up and locked it down from a terminal on the other side of the world.
You take orders on WhatsApp or WeChat and post your work on Instagram, so a website feels like something you can skip. It isn’t. You rent those platforms and can lose them overnight, buyers quietly judge whether you’re real by whether you have a site, and the AI tools people
