Keep the hackers, and the form spam, out.
Website security means we put a firewall in front of your site, block attacks on new holes quickly, stop junk messages on your forms, remove old logins and scan regularly for hidden bad code. We make yours a hard target, and we act fast when something needs it.
In one sentence: we block attacks before they reach your website, close new security holes quickly once they become dangerous, keep spam out of your inbox, and check regularly that nothing bad has slipped in.
Why would anyone hack a small business website?
It's almost never personal. Most attacks are run by automated software that tries the same known holes on millions of sites, day and night, looking for any that haven't been fixed. Your site isn't picked because of who you are. It's picked because it answered.
Once inside, attackers usually want to use your site, not damage it. They hide pages selling fake products, send visitors to scam sites, use your server to send spam emails, or host fake login pages to steal other people's passwords. Many owners have no idea for weeks, because the site still looks normal to them.
What can go wrong?
These three patterns are common on small business websites, and easy to miss:
- The hack only customers could see. Bad code hidden in the site sends people to a scam page, but only when they arrive from Google on a phone. The owner types the address straight in on a laptop and sees nothing wrong. Customers, and eventually Google, see a very different site.
- The old login nobody remembered. An agency that built the site years ago still has an admin login, with a password that was later leaked in another company's data breach. An attacker simply logs in. Nothing was "broken". The door was left open.
- The inbox buried in junk. The contact form gets fifty spam messages a week. A real enquiry from a new customer sits between two of them and is deleted by mistake. The owner then adds a hard picture puzzle to the form, and real customers on phones give up instead.
Four words, explained once
- Firewall. A guard at the door of your website. It looks at every visit before it reaches your site and turns away the ones that look like attacks.
- Virtual patching. When a new hole is found in an add-on, the firewall gets a rule that blocks attempts to use that exact hole. Your site is protected even before the add-on's maker has released a fix, or before we've finished testing it.
- Malware. Bad code hidden inside your website's files or database, put there by an attacker.
- Two-step login. Logging in needs your password plus a code from your phone. A stolen password alone is no longer enough.
Attackers move in hours, not weeks.
WordPress runs 40.1% of all websites (W3Techs, 2026). A yearly study of the security holes found in it and its add-ons shows how little time there is between a hole being found and attacks starting.
was the typical time to the first attack on the most heavily attacked holes found in 2025
of high-impact holes were attacked within 24 hours of becoming known
of holes had no fix from the add-on's maker in time for public disclosure
Built your site with Lovable or another AI builder? Check what a stranger can read.
In one sentence: a study reported on 3 November 2026 found thousands of sites built with the AI builder Lovable showing customer records to anyone, with no login, because their database access rules were missing or too open. It was a setup problem in each site, not a hack of Lovable.
Crissy Field, a German security firm, scanned 159,041 Lovable projects found online between December 2025 and September 2026. 34,545 of them used the database service Supabase. 24,664 of those sent database records to the browser as the page loaded, with no login. On 7,403 of those sites, further read-only requests returned tables holding email addresses, 10,560 tables in all.
- What was on show. Restaurants and event organisers showed ticket and food-sale records, with emails, phone numbers, postal addresses, payment information and ticket codes. A property management company showed summaries of internal emails. One provider showed more than 1,000 passport-detail records, and a forum more than 80,000 profiles and 200,000 chat messages.
- Why it happened. The rules that decide who can read each database table (Supabase calls them Row Level Security) were missing or too open. Nobody had to break in. The data was simply handed to anyone who asked.
- What the study doesn't say. The researchers say themselves that 7,403 of 24,664 sites (about 30%) is not a confirmed leak rate. Some of the email addresses may be public contact addresses or test data, the sample doesn't stand for every Lovable site, and they found no evidence that anyone misused the data.
- Not only Lovable. Any site that keeps customer details, bookings or form messages can show them by mistake if its access settings are wrong. That includes WordPress plugins, Shopify apps, Wix or Squarespace forms, and custom or AI-built apps.
Sources, checked 4 November 2026: Crissy Field's report, Sifted, India Today and Handelsblatt (in German). We can't tell from this page whether your site is affected, so do the first checks, or ask whoever built it.
Heard about "HTTP2Shell"? Here's what to ask your host.
In one sentence: HTTP2Shell (CVE-2026-111497) is a hole in Brotli, a compression tool that comes with the server your site runs on, so updating WordPress won't fix it. Your host has to.
Brotli is a common tool servers use to pack and unpack web pages. The hole is in the unpacking part. It's supplied by your server or host, not by WordPress. Brotli versions 1.0.3 to 1.2.0 are affected, and 1.0.10, 1.1.1 and 1.2.1 fix it. Some Linux systems fix it without changing the version number, so the number alone doesn't prove a server is fixed.
- How it reaches WordPress. A WordPress feature called pingbacks, part of XML-RPC, can be made to fetch a page from anywhere, without logging in. When that page comes back, the server unpacks it with Brotli, where the hole is.
- How serious it is, as of 2 November 2026. Taking over a site has only been shown in labs, on one exact server setup. The same attack failed on another setup and crashed it instead. Crashing a site is easier and works more widely. Security firms are seeing attempts to use it, but no real website has been confirmed hacked through it so far. The US cyber agency CISA lists it as exploited, with a 10 November deadline for US federal agencies to fix it.
- Why updating WordPress isn't enough. Updating WordPress, your plugins or your theme doesn't touch Brotli. Your host has to update it and restart the server.
- The "disable XML-RPC" trap. Many "disable XML-RPC" settings, including Wordfence's option for XML-RPC logins, leave pingbacks working. Turning pingbacks off closes the route shown so far, but other features that fetch pages, like link previews, feeds and some plugins, can still reach Brotli. It helps, but it isn't the fix.
- Not only WordPress. Apps built on Node.js, Bun, Python, .NET, Java and Envoy carried the same code, so it matters if you or a developer run your own server. On hosted builders like Shopify, Wix or Squarespace, no source says there's anything you need to do yourself.
Sources, checked 4 November 2026: Wordfence, Datadog Security Labs, The Hacker News, Patchstack and the CISA known exploited list (search CVE-2026-111497). We can't tell from the outside whether a given host has fixed it yet, so ask yours.
Six layers, so one gap isn't a disaster.
No single tool stops everything. Security works when several simple layers each catch what the others miss.
A firewall at the door
Visits are checked before they reach your site. Known attack patterns, bad bots and floods of login guesses are turned away at the door.
Quick virtual patching
When a serious hole is found in something your site uses, we add a blocking rule quickly, then apply and test the real fix through our safe update routine. A recent example: the Contact Form 7 6.2.4 fix.
Spam blocked on forms
Hidden traps that bots fall into but people never see, plus quiet checks in the background. No picture puzzles for real customers to fight with.
Old logins removed
We list every login on your site, remove any nobody can name, give each person their own, and turn on two-step login for every admin.
Regular malware scans
We scan your files for known bad code and for changes nobody made, and check that Google and web browsers aren't warning people away from your site.
Clean backups, just in case
If something does get through, your regular backups mean we can put back a clean copy, not start from scratch.
The security routine.
Software keeps watch on your site, day and night, like a smoke alarm. A person reads the alerts and decides what to do.
| What we do | When | What it protects |
|---|---|---|
| Firewall checks visits | As visits arrive | Stops known attacks, bad bots and login guessing before they reach your site |
| Watch for new holes in your software | Ongoing | We know when something on your site becomes a target |
| Virtual patch for serious holes | Quickly, once a serious hole is known | Closes the gap between a hole being found and the real fix being installed |
| Malware scan of files and database | Regularly | Catches bad code early, before customers or Google notice |
| Check browser and Google safety warnings | Regularly | Makes sure people aren't being told your site is unsafe |
| Review form spam that was blocked | Regularly, by a person | Makes sure no real enquiry was caught by mistake |
| Login review: who has access, two-step on | Regularly, and whenever someone leaves | No forgotten doors left open by past helpers |
| Security settings check | From time to time | File permissions, secure connection, hidden admin details, all still correct |
What happens if my site gets hacked anyway?
It's rare when these layers are in place, but it can happen to any website. This is exactly what we do, in this order. Hacked right now? Start here.
Contain it
We take the affected part offline or show a short "back soon" page, so customers aren't sent anywhere harmful while we work.
FirstClean it
We put back the most recent clean backup, or remove the bad code by hand if that's safer, and change every password and secret key.
ThenClose the hole
We find how they got in, whether an add-on, a login or a setting, and fix that, so the same door can't be used twice.
Before reopeningExplain it
You get a simple account of what happened and what changed. If Google flagged your site, we ask Google to check it again.
AfterwardsMonday, 8:00
Hi Tom, all safe. We blocked one serious attack on Wednesday.
- A hole was found in your booking add-on on Wednesday. We blocked it at your firewall that afternoon, and installed the maker's fix on Friday after testing.
- 41 junk form messages stopped. We checked them: none were real
- Scans clean, no browser warnings
- Removed a login belonging to your old web company
Names and numbers changed for illustration.
Security you can actually see.
Good security is usually invisible, which makes it hard to trust. So your Monday note tells you what was blocked, what we patched, and any login we removed, in a sentence or two each.
- Serious holes: the day we blocked them, and the day the real fix went in
- How much form spam was stopped, and that a person checked it
- Any access we removed or changed, and why
Security comes with every plan.
It's part of Protect, so it's in all three plans, with no setup fee, month to month.
Keep
$100 / month
All of Protect, including the firewall, spam blocking and regular scans.
- Quick virtual patching
- Old logins removed
- Weekly note and monthly page
Grow Recommended
$250 / month
Everything in Keep, plus help turning more visitors into calls and bookings.
- Everything in Keep
- Where enquiries get lost
- Google profile watch
Full Care
$500 / month
Everything in Grow, plus reviews, past customers and new pages.
- Everything in Grow
- Review requests to your customers
- AI answer check
What's not included?
We look after the website and everything that connects to it. Some security work belongs to other people, and we'll tell you who:
- Your office computers, phones and Wi-Fi. That's office IT, a different trade. A local IT company is the right call.
- Your email accounts and passwords. We set up your domain's email settings so messages arrive, but the mailboxes themselves are run by your email provider.
- Payment card handling. If you take payments online, the payment company handles the card details. We make sure their checkout still works, but we don't change their security.
- Legal or compliance sign-off. If your work handles health or legal records, your adviser confirms what you need.
- Cleaning a site hacked before you joined. We can do it, but it's quoted separately because every case is different.
Do it yourself, a freelancer, or Penguina?
| What you get | Do it yourself | A freelancer | Penguina |
|---|---|---|---|
| A firewall in front of the site | If you set one up | Often | Yes |
| New holes blocked quickly | Unlikely | If they're watching | Yes |
| Blocked spam checked by a person | No | Rarely | Yes |
| Old logins found and removed | If you know where to look | Sometimes | Yes, from month 1 |
| Regular malware and warning checks | No | Depends | Yes |
| A clear plan if you're hacked | No | Depends | Yes, step by step |
| Cost | Your time, plus any tools | Varies by person | In every plan, from $100 a month |
Security looks different in every trade.
What's at stake depends on who visits your site and what they type into it.
Funeral homes
Families visit at the hardest moment of their lives, often to read an obituary or service details. A hacked page or a spam-filled guestbook there does real harm. We keep public comment areas closely guarded.
Chiropractors
New patient forms can ask for health details. We keep those forms free of advertising trackers, make sure they travel over a secure connection, and keep admin access to a short, named list.
Bed and breakfasts
Booking forms attract heavy spam and the odd fake booking request. We block the bots without adding puzzles that put real guests off, and check the blocked pile regularly.
Questions about website security.
Something else? Ask in the chat, email hello@penguina.website or WhatsApp us.
How safe will my site be?
Much harder to break into than most. We put layers of protection in place, apply fixes for serious holes quickly, scan regularly, keep clean backups and follow a clear plan if anything gets through.
Do I need one of those "I'm not a robot" puzzles on my form?
Usually not. Puzzles stop some bots, but they also stop some real customers, especially on phones. We use hidden traps and quiet background checks instead, then a person looks through what was blocked, so real messages aren't lost.
Will a firewall slow my website down?
It shouldn't make any difference your customers would notice. Some firewalls even take load off your site by turning away junk traffic early. We check your page speed regularly, so we'd see it if anything changed.
A former web company still has a login. Is that a problem?
It's one of the most common open doors we find. In your first month, we list every login on your site, ask you who each one belongs to, and remove the ones nobody needs. Read more about keys in your name.
What about my customers' personal details?
We keep forms on a secure connection, keep advertising trackers off sensitive forms, and limit who can see form messages. You can read how we handle data in security and privacy.
How would I know if my site was hacked?
Often you wouldn't, which is the problem. Signs include customers mentioning odd pages, Google showing strange titles for your site, or a browser warning. Our regular scans and safety checks look for these for you, so you hear it from us first.
My site was hacked before. Can you clean it up?
Yes. Cleaning a site that's already hacked is quoted separately, because every case is different. Once it's clean and you're on a plan, everything on this page applies.
Is the security the same on Wix or Squarespace?
Hosted builders run their own firewalls and server security, so that part is theirs. We still remove old logins, turn on two-step login, keep form spam down and watch for warnings. We'll tell you exactly what applies in your first fix.
Sources for the figures on this page
- Patchstack, State of WordPress Security in 2026 (covering 2025). "Typical" here is the report's weighted median. Patchstack is a security company that sells virtual patching. Also W3Techs, October 2026
Not sure where to start? Send us your website.
We look at it the way a customer would, find up to 3 real problems, and fix one of them free. No call needed.