A commonly held notion by many businesses is that a website is something that’s built, launched, admired for a short while and then, ultimately, forgotten about.
It looks good, and it has a functional contact form, so job done… right?
Sadly, this approach is becoming less and less possible to justify. We can all see how AI is changing how pretty much everyone does things – from governments to businesses, and from individuals to criminal networks- and attackers are embracing it.
The same tools that help many to write emails faster or automate data analysis more easily can help cybercriminals find vulnerabilities at greater scale, and in much less time.
With these new rapid advancements in mind, now is an appropriate time for businesses to take a fresh look at their website and ask if now is a time to make it more robust.
How does AI increase the risk of cyberattacks?
The first thing worth mentioning is that the advent of AI hasn’t necessarily brought about new types of cyberattacks so much as it has sped them up and simplified existing ones. Here’s how the cyberattack landscape has changed because of AI:
1. Faster vulnerability scanning
Automated tools that are capable of checking thousands of websites for outdated software, known vulnerabilities and weak configurations in a fraction of the time it took before, which ultimately equates to an increase in the number of targets of cyberattacks.
2. More convincing phishing
Poor grammar, clumsy wording and other sloppy mistakes were the hallmarks of a phishing attempt for many years. These are now a thing of the past, as AI-generated messages come polished, personalised and available in multiple languages, making fraudulent emails and fake login prompts much more convincing, and harder to spot.
3. Lower barriers to entry
Tasks that, in the past, required real technical skill can now be at least partially automated, opening the door for more people to attempt attacks.
4. Shorter response windows
When a vulnerability becomes public, the gap between discovery and exploitation can be very small. Therefore, the time you have to ensure site updates and fixes are in place, and the time it takes for an attack to be attempted, is tighter than it ever was before.
The reality is that AI has made it so that the time you have to react is shrinking.
A website that gets looked at just once a year is exposed for much longer than one that’s maintained consistently.
Does this affect smaller businesses too?
An easy assumption to make is that cyberattacks are only directed at big brands, but small and medium-sized businesses are still in the frame when it comes to cyberattacks.
In fact, most automated cyberattacks aren’t even targeted to any one business.
Bots simply search for easy openings, regardless of whether your business employs 5 or 5,000 people.
All it can take is one outdated plugin, an unpatched content management system, or a forgotten admin account. For smaller businesses, the consequences of this could be a hijacked website, lost enquiries and customer data being exposed. Indirectly, a lot of time and cost is required, as a result, to set it right.
We’ve observed instances where smaller businesses, who don’t collect meaningful user data on their websites, have had their contact forms hijacked by bad actors who insert fake CAPTCHA fields on to forms, which in turn may install malware on the devices of visitors to your website who are trying to launch an enquiry with you.
It can also redirect visitors to other unsafe, bad faith or scam websites which can affect long-term SEO rankings.
If your website handles any personal data at all, even just from contact forms, but also including customer accounts or newsletter sign-ups, there is a GDPR dimension, too, and so ensuring your website remains secure is your responsibility to remain compliant.
Why else should I keep my website updated?
The good news is that most of what protects your website also makes it a better website.
1. Site speed and performance
Websites with updated software, clean code and well-managed hosting naturally load faster. This matters to visitors and for your website’s visibility on search engines like Google.
2. SEO and visibility
When your website is fast, secure (HTTPS) and regularly maintained, it’s rewarded with higher search engine rankings. However, having a compromised website can lead to it being flagged with warnings or even fully removed from search engines, and this can take a long time to recover from.
3. User trust
Eventually, it becomes evident when a website feels neglected. Broken links, outdated content, security warnings to a user’s browser. People do notice these things. A well-maintained site signals that your business is both active and reliable.
4. Compatibility
Devices, software, browsers and customer expectations are always evolving, so regular maintenance ensures that things remain fit for purpose.
Of course, a polished, aesthetically pleasing site is good for your brand. But your website’s appearance is only half the picture if it’s quietly out of date under the hood. It’s almost a bit like having a striking shopfront display but leaving your shop’s back door unlocked.
How can I keep my website well-maintained?
Most businesses don’t need an enterprise-level security operation. In conjunction with you and your web developer, good maintenance looks like this:
- Keep everything updated, including everything from your CMS and themes to your plugins and any third-party integrations.
- Practise good account security by ensuring strong, unique passwords and two-factor authentication are used for every administrator and hosting account.
- Run regular, tested backups, stored somewhere separate from your website.
- Monitor your website for uptime, unusual activity and security issues so that problems are spotted early.
- Remove anything that is not used, including old plugins, old accounts and abandoned pages, as these are all potential weak points.
- Review all users to ensure former staff and contractors no longer have a way in.
- Keep an eye out for anything unusual, such as large spikes in traffic from countries you don’t operate in, or a series of documented failed login attempts, as this may point to bad actors sending bots to attempt to access your website. Let your developer know of such instances to implement further layers of security.
- Know who to call and what to do should anything go wrong.
Should I get a new website?
Regular maintenance helps to keep your website healthy.
That said, it can’t keep going on forever without redevelopment. Every website is built on a foundation of software, frameworks, hosting environments and design conventions, and as with most things in life, these age, and at a certain point, patching an old build ends up costing more, and protecting you less, than simply starting afresh with a new website.
As a rule of thumb, most businesses should consider a meaningful refresh every 2 to 3 years, and a complete website rebuild every 4 to 6 years, though it’s important to note that AI advancements are likely to make technologies outdated faster as time goes on.
A refresh is an update to the design, content, structure and user experience, assuming that it is still built on a sound technical foundation, whereas a rebuild goes further, by replacing the foundation itself – the platform, theme, code and infrastructure.
Usually, if a number of the following are occurring, you should consider a new website:
- Your platform, or key plugins that you require, are no longer supported. If the software is end-of-life, or if plugins you use are no longer compatible with your build, security fixes can’t be addressed and your website becomes vulnerable to attacks.
- Updates begin breaking things. If updating things becomes something you start to avoid for fear of something falling apart, your website’s build has become brittle.
- The site is slow and can’t be improved. Too many ‘workaround’ bolted-on features will eventually leave behind bloated code that ultimately can’t be fixed.
- It doesn’t run well on mobile, or can’t reach modern accessibility standards.
- Maintenance costs start to rise while results fall. At a certain point, you start to pay more just to preserve the old website than a new one would cost.
A good rebuild resolves all of these issues, while preserving your existing SEO value through proper redirects, retains content that performs well and cleans up any longstanding clutter or unused accounts along the way for both high performance and security.
Think of a website like a car. Regular servicing keeps it reliable for years, but at a certain point it just makes more financial and safety sense to replace, rather than repair.
Frequently asked questions
Does AI make websites more vulnerable?
Indirectly, yes it does. This is because AI makes it faster and cheaper to locate weaknesses that already exist which they can exploit, including outdated software and weak passwords. Ensuring your website is regularly maintained and looked after closes these gaps.
How often should my website be updated?
When new security updates are available, they should be applied as soon as possible, ideally within a couple of days of release. A monitored maintenance plan makes this a dedicated, outsourced routine, rather than a reactive scramble.
How often should I get a brand new website?
It’s general best practice to refresh your website every 2-3 years and to rebuild it fully every 4-6 years, the latter allowing for a whole new foundation that includes platform, code and hosting setup for a more secure website. Businesses should also consider that AI advancements means that technologies will soon become more outdated, faster.
What is a website refresh, and what is a website rebuild?
A refresh is most focused on what people can see on the surface – design, content and user experience, but it is built on top of your existing website’s technical foundation. Whereas a rebuild replaces this foundation, including the platform, code and hosting setup. It is the foundation that is most exploited by bad actors.
Are small businesses really at risk of cyberattacks?
More than most people realise. Many attacks are automated and do not discriminate by size. Being an SME doesn’t put you in the clear, and no business can afford to lose time or trust due to an otherwise unavoidable incident.
What should I do to make sure my website is safe?
Some of the obvious first actions are to ensure your software is up to date, make sure that your employees have strong passwords with 2FA set up, and confirm that you have a backup that you can actually restore should anything happen. Next, find out when your site was last built, and whether its platform is still supported today.
Staying secure in a changing world
We can all see that the online world has become faster, more dynamic and, let’s face it, riskier than ever before. This doesn’t mean we should be fearful, but it should make us proactive. Keeping your website regularly maintained protects what you have now.
Knowing when your website is past its best, and refreshing or rebuilding it when needed, is crucial to keeping your website defended against bad actors.
If you’re struggling to decide how well looked after your website is, or whether it’s due a rebuild, we’d be happy to take a look.
Want to know more? Our Web Development page says it all.
And of course, we’re already ready to chat: info@vitamin.ie | 051 585 210