Your Website Is Your Front Door: Keeping It Locked in the Age of AI

A website is never really finished

When a new website goes live, it feels done. In a way it is: the pages are written, the photos are in, and the Book Now button works.

But a website is more like a car than a painting. It runs on software, and that software is updated regularly by the people who make it. Most of those updates fix safety problems, so a site that never gets them slowly becomes easier to break into.

Most WordPress websites, including the ones I build, are made from three parts: WordPress itself, a design theme, and a handful of plugins that add features. In 2025, security researchers at Patchstack recorded 11,334 new weaknesses across the WordPress world, up 42% on the year before. 91% were in plugins and 9% in themes. WordPress itself had only six, all minor.

That is actually reassuring. The foundation is solid, and the weak spots are the add-ons, which are exactly what regular care keeps up to date.

What AI has changed

AI has made it much faster to find weaknesses in software. Between January and late July 2026, the US national vulnerability database logged 45,207 security flaws, almost as many as in the whole of 2025, which was itself a record year.

Much of this is good news. Big companies now use AI to find and fix their own flaws before anyone can misuse them. In one July update to the Chrome browser, Google found 401 of the 433 flaws it fixed itself.

The catch is that attackers have AI too, and they are getting faster:

• From flaw to attack in a day. The security firm Recorded Future found that the average time for attackers to turn a newly announced flaw into a working attack dropped from 72 hours in 2025 to 24 hours in 2026.
• WordPress moves even faster. Patchstack found that about half of high-impact WordPress weaknesses are attacked within 24 hours of being announced. For the most popular targets, the typical time is about 5 hours.
• Website systems are a favourite target. Website platforms like WordPress made up a third of all confirmed attacks on known flaws in the first half of 2026, according to VulnCheck.

It helps to know how these attacks work. Nobody is sitting at a desk targeting your guest house. Automated programs scan thousands of websites at a time, looking for any site still running an outdated plugin. It is less like a burglar choosing your house and more like someone walking down the street trying every door handle.

The balanced view: VulnCheck also found that only around 1.3% of flaws ever get used in a real attack. Most never touch a small business. But when one does, the window to act is now hours, not weeks.

What can actually happen to a small business website

Most hacked small business websites are not wiped out. They are quietly used for someone else’s purposes, often without the owner noticing for weeks. The common results:

• Visitors sent elsewhere. Some guests who click your link land on a scam site instead. Modern malware often shows the owner a normal-looking site, so you may only find out when a guest complains.
• Hidden spam pages. Attackers add pages selling dubious products, which can push your real pages down in Google.
• A browser warning. Google and browsers may flag the site as unsafe, and most people leave as soon as they see that.
• Changed links or buttons. A Book Now link or contact detail can be swapped for someone else’s.
• Repeat infections. Patchstack’s partner Monarx found that today’s malware is increasingly built to hide and to reinstall itself after a clean-up, so it is far easier to prevent than to remove.

One detail stood out for anyone in hospitality: Monarx saw malicious uploads to websites nearly triple in November and December 2025. Attackers know the festive season is busy and that fewer people are watching. For guest houses, that is also peak booking season.

Why it matters for your bookings

For a guest house or holiday home, your website is your own booking channel. Every guest who books through your site, rather than through a booking platform, saves you that platform’s commission and builds a direct relationship with you.

That only works if guests trust what they see. A browser warning, a broken button or a strange redirect sends them straight back to the big platforms, or to the place down the road.

There is also your guests’ information to think about. Contact and newsletter forms collect names and email addresses. Keeping your website secure is part of looking after that information responsibly, which South Africa’s privacy law, POPIA, expects of every business.

What good website care looks like

The good news is that keeping a simple website safe is not complicated. It just needs to happen regularly, and someone needs to be paying attention:

• Regular updates to WordPress, the theme and every plugin.
• Fewer moving parts. Unused plugins are removed, because every add-on is another door to lock.
• A security firewall that blocks known attacks and sends alerts when a new threat affects your site.
• Automatic backups stored somewhere other than your hosting, so the site can be restored quickly if anything goes wrong.
• Regular checks that the site loads securely, forms work and the Book Now buttons go to the right place.
• A quick response when a serious new flaw is announced. With attacks now arriving within hours, waiting for the next routine check is not enough.
• Clear ownership. You should always know that your domain and hosting are in your name, and who looks after them for you.

How I can help