In May 2024, a mid-sized e-commerce business in Delhi lost customer data for over 40,000 users because their WordPress installation had not been updated for fourteen months. The breach was entirely preventable. The recovery — legal fees, PR management, technical cleanup, compensation offers — cost more than rebuilding the entire website from scratch would have.
This story is not unusual. CERT-In (India's cybersecurity agency) reported a 67% increase in cyberattacks targeting Indian SME websites in 2024 compared to the previous year. The targets are not sophisticated — they are opportunistic. Automated bots scan the internet continuously for known vulnerabilities, and outdated websites are the easiest targets.
The Most Common Attack Vectors on Indian SME Websites
SQL Injection: An attacker sends malicious input through a form field that manipulates your database queries. Poorly written custom code or outdated plugins are the most common entry points. A successful SQL injection attack can expose your entire database — including customer names, emails, phone numbers, and payment history.
Credential Stuffing: Attackers use lists of username/password combinations leaked from other sites to attempt logins to your admin panel. If your admin password is also used on another service that has been breached, your site is vulnerable. Indian websites with wp-admin or /admin on default URLs are targeted thousands of times a day.
Cross-Site Scripting (XSS): Malicious scripts are injected into pages viewed by other users, often through unvalidated comment fields or contact forms. The goal is often to steal session cookies or redirect users to phishing pages.
Outdated Plugin Vulnerabilities: Every major plugin vulnerability is publicly disclosed after a patch is released. This means attackers know exactly what to look for on unpatched installations. Running a WordPress site with plugins that have not been updated in 90+ days is a measurable security risk.
The Non-Negotiable Security Baseline for Indian Websites
Regardless of the platform your website is built on, the following are the minimum security measures that every business website should have in place:
- HTTPS Everywhere: Every page should load over HTTPS. If any part of your site loads over HTTP — especially forms — both Google and browsers will flag this. Free SSL certificates via Let's Encrypt have eliminated the cost barrier; there is no excuse for HTTP in 2025.
- Strong Admin Credentials: Admin username should never be "admin". Passwords should be 16+ characters, randomly generated. Use a password manager. Enable two-factor authentication on your hosting control panel and CMS admin.
- Regular Backups: Daily automated backups stored off-server (separate hosting account or cloud storage). Test your backups by actually restoring from them at least once per quarter. A backup you have never tested is not a backup — it is a hope.
- Web Application Firewall (WAF): Services like Cloudflare's free WAF block a significant percentage of common attacks before they reach your server. This single step can reduce attack surface dramatically with almost no setup complexity.
- Regular Updates: CMS core, themes, and plugins should be updated within 72 hours of a security patch release. If your developer has not structured a maintenance contract for this, it needs to be addressed.
What the PDPB Means for Your Website
India's Digital Personal Data Protection Act (DPDPA) came into force in 2024 and changes the legal landscape for websites that collect user data. If your website has a contact form, a newsletter signup, a checkout process, or user accounts — you are collecting personal data and are subject to this law.
At minimum, this means having a clear, compliant Privacy Policy, obtaining explicit consent before collecting data, and having documented processes for responding to data deletion requests. The penalties for non-compliance are significant — up to ₹250 crore per instance for serious breaches.
If your website's privacy policy was generated by a free online tool three years ago and has never been reviewed by counsel, it is time to address that.
The Cost of Prevention vs. Recovery
A comprehensive website security setup — including a WAF, proper backup system, security monitoring, and regular updates — typically costs between ₹5,000 and ₹15,000 per year for a small business website. The average cost of recovering from a serious security breach in India is between ₹3 lakh and ₹15 lakh, depending on the nature of the breach and regulatory exposure.
The mathematics of website security are simple. If you would like a security review of your existing website, our team at Webzy offers comprehensive security audits that identify vulnerabilities before attackers do.