In 2023, 16% of Canadian businesses were hit by a cyber security incident, according to Statistics Canada, and their combined spending on recovery doubled to $1.2 billion from $600 million 2 years earlier. A large share of that exposure starts on a server the owner never sees. The company website and its customer logins run on hosting infrastructure, and the security of that infrastructure determines how many attack routes are open before the owner makes a single choice.
Common Attack Routes Into Small Business Sites
Verizon’s 2025 Data Breach Investigations Report found that exploited vulnerabilities were the first point of entry in 20% of breaches, a 34% increase on the prior year. Ransomware appeared in 88% of breaches at small and medium businesses, compared with 39% at large organizations. Smaller firms rarely employ anyone whose only job is watching servers, so an unpatched flaw can stay open for months before anyone notices it.
Patchstack, which tracks flaws in the WordPress ecosystem, recorded 7,966 new vulnerabilities in 2024, about 22 a day, and 96% of them were in plugins. More than 50% of the plugin developers it contacted about a flaw left it unpatched until public disclosure. Each vulnerable plugin gives an attacker a possible way onto the server it is installed on. Attackers scan for known flaws with automated tools, so a bakery’s site in Moncton receives the same probes as a national retailer’s. Breaches involving a third party doubled to 30% in Verizon’s data, and a plugin written by an outside developer is third-party code running on the business’s own server.
Patch Schedules for Server Software
A website depends on a stack of software below the content management system. Each layer has its own flaws. The operating system, the web server, the database engine and the scripting language each receive security patches on their own schedules. The Canadian Centre for Cyber Security includes automatic updates in its baseline controls for small and medium organizations, and recommends turning them on for all software and hardware where the option exists.
On a managed server, the owner never applies these patches and usually never sees them happen. A small firm without an IT department gets most of its server security from reliable web hosting. The provider’s staff close known flaws on a schedule and keep the site online while they work.
W3Techs data for October 2026 shows 27.8% of PHP websites still running version 7 and another 7.8% on version 5. Every PHP 7 branch stopped receiving security fixes when version 7.4 reached end of life in November 2022, so those sites depend on code that nobody patches anymore.
Account Isolation on Shared Servers
Many small business sites share a physical server with hundreds of other customer accounts. Without isolation, one compromised account can be used to read or alter files in the accounts beside it. Secure hosts separate each account at the file system level, often with containers or strict per-user permissions, so malware planted in a neighbour’s abandoned blog stays inside that one account. The owner never sees this control. It still limits how far an intrusion on someone else’s site can spread. The same separation limits damage from mistakes inside the business, such as an old staging copy of the site left online with a weak administrator password.
Malware Scans on Hosted Accounts
Patched servers still get infected. A secure host scans account files on a schedule for known malicious code and watches for unusual outbound activity, such as a contact form that suddenly sends thousands of messages an hour. When it finds a problem, it alerts the owner and quarantines the affected files. The 2025 Cost of a Data Breach study, conducted by the Ponemon Institute, credited improved detection and containment for the first fall in average breach costs in 5 years.
Firewall Filtering and Denial-of-Service Protection
A web application firewall inspects incoming requests and drops the ones that match known attack patterns before they reach the site’s code. Wordfence, which runs a firewall on WordPress sites, reported blocking 9 billion cross-site scripting attempts and 1.1 billion SQL injection attempts in 2024. Filtering at the server level stops a large portion of that traffic before any plugin has to process it.
Denial-of-service attacks aim to take a site offline with a flood of traffic, and their volume climbed sharply in 2025. DDoS attacks in 2025 nearly matched the full 2024 total within the first quarter, with 20.5 million recorded in 3 months against 21.3 million for all of the previous year. Upstream filtering at the host absorbs a flood of that kind, while a small server without it stays offline until the attack ends.
Encrypted Connections and Login Controls
Stolen or guessed credentials were the initial access vector in 22% of breaches in Verizon’s 2025 report, and Wordfence counted more than 55 billion password attacks in 2024, launched from nearly 136 million distinct IP addresses. Secure hosting limits that exposure with rate limits on login attempts, automatic blocks on addresses that fail repeatedly, and the option to require two-factor authentication on the hosting control panel itself.
Automatic issuing and renewal of TLS certificates keeps form submissions and payment pages encrypted at all times. An expired certificate triggers a browser warning on every visit, and customers who see that warning tend to leave before they enter any details.
Off-Server Backups
Ransomware and destructive malware are survivable when a clean copy of the site exists somewhere the attacker cannot reach. Good hosts store daily backups on separate systems and let the owner restore a site from the control panel in minutes. The baseline controls from the Canadian Centre for Cyber Security call for backups that are secured and tested, so a restore works on the day it is needed. A working backup also changes the ransom decision. Verizon’s 2025 report put the median ransom payment at US$115,000, with 64% of victims refusing to pay, while Statistics Canada reported that 88% of Canadian businesses hit by ransomware in 2023 made no payment at all.
The Ponemon study put the average breach lifecycle at 241 days in 2025, a 17-day reduction from the year before, and organizations that detected a breach internally saved about US$900,000 on its cost. For a small business, a backup taken last night and a restore that takes an hour are the difference between a short outage and a week of lost orders.
The Price of an Unprotected Server
Ponemon’s figures put the global average cost of a data breach at US$4.44 million in 2025, a 9% drop from the year before, while the American average jumped 9% to a record US$10.22 million. Canadian small businesses face smaller sums. Statistics Canada puts their own recovery spending at about $300 million for 2023. A business that skips server-level security accepts that its website can become the entry point for ransomware or several days of downtime, and that it will pay the recovery bill after the damage is done.
