Website security without an admin login: fewer doors, fewer worries

For many small business owners, website security sounds like something that needs a dedicated technical person and monthly supervision. In reality most incidents look far simpler than that: an outdated plugin, a theme nobody has touched in years, and a password that has been used somewhere else too. If none of those things exist on the site, most of the worry disappears along with them. Let us look at two things: where attacks actually come from, and what it means to run a site with no admin interface and no database.

Where attacks actually come from

An automated attack does not pick its victim by company size or turnover. Scanners run across the internet constantly, looking for software with a known vulnerability. When a scanner finds a site running a plugin that has not been updated for two years, it tries exactly the hole that version allows. Your company name and line of business play no part in that calculation.

The second way in is the login page. Addresses such as /wp-admin and /wp-login.php are publicly known, and they get tried against thousands of previously leaked passwords. The third route is the hosting account itself: an old FTP password that was once emailed to a developer and is still sitting in that inbox. None of these three requires any cleverness from the attacker, only patience and automation.

The outcome is rarely dramatic. Far more often, hidden links to unfamiliar sites are added to the pages, or your server starts sending spam. The owner finds out only when a search engine flags the site as suspicious and organic traffic drops within a couple of days. Google has put together separate guidance on hacked sites, but cleaning up and earning trust back takes weeks either way.

The admin interface is the widest door

A content management system is made up of three layers: the core, the theme and the plugins. Each one is a separate piece of software with its own author, its own release pace and its own bugs. A site with ten plugins is a site with ten separate projects whose security fixes somebody has to follow. If one of them goes six months without an update, the door is open even when the other nine are in good order.

Updating is not a free activity either. Every click can knock something out of place in the design, so most owners keep putting it off. That is how you end up with a site that looks perfectly tidy from the outside while running year old software underneath. The update notice arrives in the inbox every month, and every month it stays unopened.

Three common misconceptions

• We are too small for anyone to attack us. An automated scanner knows nothing about your turnover.
• A security plugin solves it. That is simply one more piece of software to keep updated, and it does not close the login door.
• An HTTPS certificate makes the site secure. A certificate encrypts traffic, but it does nothing about a weak password or an outdated plugin.

What is left without a database

A static site consists of prepared HTML, CSS and image files. When a visitor opens a page, the server hands over a finished file. No code runs on the server and no database query is made. That sounds like a technical detail, but in security terms a whole set of attack routes disappears at once.

• There is no database, so there can be no SQL injection and no database leak.
• There is no public login page, so there is nowhere to try passwords.
• There are no plugins, so there is no third party code waiting on a security fix.
• The files are closed for editing on the server, so an attacker has nothing to write into.

Forms and bookings do not disappear anywhere, they simply do not live on your website server. Contact form data goes to a separate service and from there to your inbox. For arranging appointments, a booking system at 19 € per month plus VAT keeps the calendar and client contacts in a system of its own. Hosting is 0 €, because a static site needs no running server process for anyone to keep alive and patched.

A backup that has actually been restored

The value of a backup does not come from how often it is made. It comes from whether anyone has ever genuinely put a copy back. Plenty of sites run nightly backups for years, and then on the first serious day it turns out the copy contains only the database and not the uploaded images, or that restoring it needs access nobody has any more.

When the site source code is in version control, every earlier state is stored separately. Restoring means publishing an older version again, and that takes minutes rather than days. No database export, no hunting for files by hand, no asking the host for a three day old copy.

• Where the copy is kept and who can reach it
• How recent the newest state is that can be put back
• How long restoring actually takes
• Who does the restoring when you are on holiday

Those four questions are worth asking about your current site even if you are not planning to change anything. Examples of finished work can be found among our completed projects.

Editing content without a login page

The most common objection is that without an admin interface the owner can no longer change anything themselves. In practice the change simply takes a different route. You send the new text, price or image, the change is made in the source file, and the site is published as a new version. The previous state stays available, so if the new version is not right you can go back. And no public door is created for anyone to try passwords against.

What this means for you

You no longer have to decide whether to press the update button. You no longer pay a monthly maintenance fee whose main content is keeping software current. A website costs 790 € plus VAT, hosting is 0 €, and a seasonal campaign page is 79 € plus VAT. If you want the site developed further with content on an ongoing basis, our SEO service covers that at 379 € per month plus VAT. All the figures are listed on the pricing page.

If you want to know how many doors are open on your current site, get in touch and we will carry out a free audit. You get a written overview with no obligation to order anything.