A piece in DevOps.com argues that most software teams put their security effort into the period before a site or app goes live, then largely stop checking once it is running. The article makes the case for testing live systems continuously, in ways that do not knock them offline.
That is written for teams with dedicated security staff, and most of it will not apply to you. But the underlying point does, and it is one worth sitting with.
The article cites a survey finding that more than 70% of applications are likely to have an active vulnerability after five years in production, and that 30 to 40% of teams run security testing quarterly or less. Think about what that means for a website built four years ago that has been quietly running since. It was probably fine on launch day. The plugins, the themes, the payment integration and the hosting stack have all changed since then, and nobody has looked.
For a small business, this rarely shows up as a dramatic breach. It shows up as a contact form silently sending to a dead inbox, a booking system that stopped syncing after an update, a plugin the developer abandoned three years ago, or Google flagging your site as unsafe and cutting your traffic without warning. The damage is usually slow and commercial rather than sudden and technical.
You do not need continuous automated security testing. What you need is somebody looking at the site on a schedule instead of only when something breaks.
What to actually do
Find out when your site was last updated, and by whom. If the answer is "when we built it" or you genuinely do not know, that is your answer.
Ask whoever maintains your site three questions: are plugins and the core platform being updated, is there a working backup you have tested restoring from, and is anyone checking that forms, bookings and payments still work.
If you have no maintenance arrangement at all, that is a conversation to have, not an emergency. But have it this quarter rather than next year.
Reported by:
