Outdated plugins
Vulnerabilities in extensions and themes are published openly, after which bots search for sites where they haven't been patched yet. Update your add-ons and remove those the developer no longer maintains.
Security
Security
Small websites get hacked not because anyone is interested in them, but because they are easy to find automatically. Bots guess passwords, hunt for outdated plugins, register spam accounts and leave links in comments. This section describes the main threats, their warning signs and simple protective measures, plus general legal requirements for personal data and advertising. We don't name specific software: what matters is understanding the principle, not memorising a list that will quickly go out of date.
The cheapest protection for a site is updates, unique passwords and a backup you have restored at least once.
How this section works: we describe threats in general terms, without naming software or services and without made-up statistics. Information about laws is general background, not legal advice.
Threats
Six threats that small website owners face most often.
Weak passwords
A simple or reused admin password gets guessed automatically or leaks along with another site's data. Use a password manager and two-factor authentication.
Spam sign-ups
Bots create accounts on forums and in comments to leave links to dubious sites. Such profiles damage a site's reputation and can lead to search engine penalties.
Malicious injections
Attackers add hidden links, redirects or scripts to the code that not every visitor sees. The owner may not notice for a long time, so it's worth periodically checking your files and the search results for your site.
Hosting phishing
Emails about an "account suspension" or an "unpaid invoice" lead to fake login pages for your hosting or registrar panel. Log in to panels only via saved bookmarks or a manually typed address.
Domain loss
Domains are lost when owners forget to renew them, when they're registered to a contractor, or when the email on file with the registrar is hijacked. Turn on auto-renewal and protect that email separately.
Personal data and advertising
In Russia, the processing of personal data is governed by Federal Law No. 152-FZ on Personal Data, adopted in 2006. If a site collects visitors' data — through contact forms, registration or newsletters — it must obtain consent for processing and publish a personal data policy describing what data you collect, why and how long you keep it. Other countries have their own rules, such as the EU's GDPR.
Since 1 September 2022, mandatory labelling of online advertising has applied in Russia, introduced by amendments to Federal Law No. 38-FZ on Advertising. If you place ads or advertising materials on your site, find out what obligations this creates for you as a publisher; other countries have their own advertising rules.
This is general background, not legal advice. Legal requirements get refined over time, so before launching forms, newsletters or advertising, check the laws in force where you operate or consult a lawyer.
Related sections
- Fixes
Site won't load, site hacked, comment spam, site gone from search, slow loading, certificate error — what to do.
- Guides
Step-by-step guides: domain and hosting, HTTPS, backups, updates, privacy policy. The article catalogue lives here too.
- FAQ
Answers about this reference, launching and maintaining a site, money and the law.
Sources
- Federal Law No. 152-FZ on Personal Data
- Federal Law No. 38-FZ on Advertising
- Let's Encrypt
Information on standards and laws is based on official sources as of the preparation date. Technologies, search engine rules and laws change, so check the current documentation and the laws in force.