Many cyberattacks on businesses are cheap to launch because they are automated and sold as services: rented botnets for denial-of-service floods, lists of leaked passwords, ready-made phishing kits and scanners that look for unpatched software. The low cost to the attacker says nothing about the cost to the victim, which can include downtime, fraud and lost customer trust. The defences below are practical, layered and mostly affordable, and they stop the majority of these commodity attacks.
What cheap attacks look like
We describe these so you can recognise and defend against them, not repeat them.
Denial-of-service for hire
Attackers rent networks of compromised devices to flood a website or server with traffic until it cannot serve real visitors. Small sites on a single server are easy to overwhelm without protection at the network edge.
Credential stuffing
Usernames and passwords leaked from other websites are tried automatically against your logins. Anyone who reused a password is exposed, including staff on email and website admin accounts.
Phishing kits
Ready-made fake login pages and email templates let criminals impersonate your business, your bank or a supplier. A common variant in business email compromise is a message asking accounts staff to change a supplier’s bank details.
Automated vulnerability scanning
Bots scan the internet for outdated plugins, exposed admin panels and known software flaws, then exploit them to plant malware, spam pages or backdoors. Small websites are found because scanning is indiscriminate, not because they are important.
Why a small attack can cause large damage
- Downtime: if customers cannot reach your site or email, orders and enquiries go elsewhere.
- Fraud: one convincing email can redirect a payment to a criminal’s account.
- Search and reputation: a hacked site can be flagged by browsers and search engines, warning visitors away.
- Recovery effort: cleaning up, restoring and investigating usually costs more than prevention.
A layered defence checklist
At the edge of your website
- Web application firewall (WAF) to block common web attacks before they reach the server.
- DDoS mitigation through a network such as Cloudflare, so floods are absorbed away from your server.
- Bot management and rate limiting on logins, forms and checkout.
On accounts
- Multi-factor authentication on email, hosting control panels, website admin and banking.
- A password manager, with unique passwords for every service.
- Separate admin accounts for each person, removed the day they leave.
On software
- Update the CMS, plugins, themes and server software promptly, and remove plugins you do not use.
- Run scheduled vulnerability and malware scans.
- Protect laptops and servers with managed endpoint security.
On email
- Set SPF, DKIM and DMARC on your domain so criminals cannot easily send mail that appears to come from you.
- Filter incoming mail for phishing and malware.
- Confirm any change to payment details by phone, using a number you already hold.
On recovery
- Daily backups stored separately from the live site, and a tested restore.
- A short incident plan: who to call, who decides, and how you tell customers.
- Regular phishing awareness training for staff.
Matching protection to the size of the business
A single website
Armor Guard is Cloudflare Pro, configured and monitored by Tremhost, for $9 a month or $90 a year for one site. It adds a managed WAF, DDoS protection and bot controls in front of the site. There is a free 15-day Cloudflare Pro trial that needs no card.
Laptops and servers
Tremhost supplies ESET endpoint security for antivirus, encryption and ransomware protection on each device.
A business without a security team
Tremhost’s managed security plans, in US dollars:
- Essential Security, $200 a month: Cloudflare Pro setup and management, SSL/TLS, WAF, malware detection and removal, email security and spam filtering.
- Advanced Security, $300 a month: adds DDoS mitigation, vulnerability scanning, managed antivirus for servers and endpoints, and security awareness training.
- Professional Security, $700 a month: adds intrusion detection and prevention, endpoint security management, bot management and compliance support.
- Enterprise Security, $2,000 a month: adds Cloudflare Business, multi-domain wildcard SSL, zero-day exploit protection, penetration testing and a managed security operations centre.
Yearly billing saves $100 to $300 a year.
If you have already been hacked
Armor SOS triages hacked websites free on the same working day and then quotes the clean-up. In the meantime, change passwords from a clean device, put the site in maintenance mode if it is serving malware, and keep logs for investigation.
Frequently asked questions
Are small businesses really targeted?
Yes. Most commodity attacks are automated and indiscriminate, so any site or mailbox with a weakness can be hit.
What is the single most useful step?
Turn on multi-factor authentication for email and every admin login. It defeats most credential stuffing.
Do I need a managed plan or just a firewall?
One website with someone to maintain it can start with a firewall such as Armor Guard. Choose a managed plan when you have servers, laptops and staff to protect and no one responsible for security.
Next step
Compare the four plans and use the plan finder on the Tremhost managed security page.
