Your Website Looks Fine. Could It Be Sending Customers to Scammers?

Your Website Looks Fine. Could It Be Sending Customers to Scammers?

Imagine a customer searching for a plumber in Hervey Bay.

They find your business, recognize your name and open your website. Instead of your service page, they land on an unfamiliar page asking them to download something.

You open the same website later. Everything looks normal.

That is a hypothetical situation, but the behavior behind it is real. Google documents how hacked websites can redirect some visitors depending on their device or how they arrived. A site can behave differently for someone coming from Google than for its owner opening it directly.

For small businesses in Australia, website security needs to protect the journey customers actually take.

Why this matters to Australian business owners

ASD’s Annual Cyber Threat Report 2024–25 recorded an average self-reported cybercrime cost of approximately A$56,600 for small business, up 14% from the previous financial year.

That figure covers reported cybercrime broadly. It is not the average cost of a website hack, a forecast for your business or a loss experienced by every Australian small business.

It does show why digital security deserves attention alongside marketing, quoting and everyday operations.

A website problem can become a customer problem

A business website may handle enquiries, send visitors to booking tools, display contact details and help customers decide whom to trust.

When something goes wrong, the consequences can extend beyond the website itself.

A broken form or outage is not automatically evidence of a cyber attack. Software faults, configuration changes and expired services can produce similar symptoms.

The useful response is to investigate promptly.

If you are reviewing the wider customer experience, our website trust checklist covers what customers look for before contacting a business.

Why a normal-looking homepage is not enough

Google’s guidance describes hacked content, injected pages and redirects that can depend on the visitor’s device or referral source.

That means checking only the homepage from your usual browser can miss a problem.

If a customer reports an unexpected page, take the report seriously. Ask which address they opened, whether they arrived from search and what happened next. Ask them to avoid further interaction with the suspicious page.

Have your website provider investigate. A screenshot of a normal homepage does not settle what another visitor experienced.

Seven website security checks worth doing

1. Protect the accounts that control the website

Your website depends on more than its administration login. Hosting, domain registration and the associated business email account also matter.

Turn on multi-factor authentication (MFA) wherever supported. It adds another verification step, making a stolen password alone less useful to an attacker.

Use unique passwords and a reputable password manager. Give staff and suppliers their own accounts with only the access they need. Remove access when their role ends.

Keep recovery options current so the authorized people can regain access if necessary.

2. Make security updates someone’s responsibility

A website may rely on a content management system, themes, plugins, libraries and hosting software. Those components need ongoing attention.

Australian guidance recommends applying security patches promptly, especially for internet-facing systems such as websites. Software that no longer receives security updates should be removed or replaced.

Ask your provider:

• Which components need updates?

• Who checks for important security fixes?

• How are changes tested?

• How quickly are urgent fixes handled?

A monthly report can document maintenance, but urgent security patches need a process that responds to their urgency.

3. Check whether the backup can actually restore the website

A message saying “backup completed” does not tell you whether the business can recover.

Confirm that backups include what is needed to restore the site, such as its content, relevant database and configuration. Ask how backups are protected and whether earlier versions are retained.

Then ask when a restoration was last tested.

Backup frequency and recovery time are different questions. A daily backup describes how often a copy is taken; it does not promise that restoration will take minutes.

Australian cloud-security guidance specifically encourages businesses to clarify backup responsibilities and test restoration.

4. Use HTTPS and understand what it protects

HTTPS encrypts information while it travels between a browser and a website.

It is an important protection, but it does not prove that the website’s content is trustworthy or that the business behind it is legitimate. Chromium’s security team explains that phishing websites can also use HTTPS.

Keep certificates valid and ensure that forms and connected services use appropriately protected connections. Continue checking access, software and content separately.

5. Check the site as a customer encounters it

Review important pages on a phone and through the normal routes customers use, including search results.

Check whether contact buttons, quote forms and booking links lead to their intended destinations. Submit a clearly labelled test enquiry and confirm that it reaches the right inbox.

Also review Google Search Console’s Security Issues report. It identifies security problems Google has detected and provides guidance. Treat it as one source of evidence; an empty report is not a complete security assessment.

Reliable website design for trade and service businesses needs to support the enquiry journey, with ongoing checks after launch.

6. Know who handles hosting, renewals and support

Ask who controls the domain, receives renewal notices and can contact the hosting provider.

Australian website-security guidance recommends renewing domains before expiry and understanding a host’s backup and security features.

Keep authorised access and support details documented. Check that alerts reach someone who can act.

A provider may manage the server while your business remains responsible for accounts, content or connected tools. Confirm the division rather than assuming “hosting included” covers everything.

An ongoing website care plan can organise maintenance and monitoring. Its scope should be clear.

7. Review the customer information you collect

A quote form may collect names, phone numbers, addresses and details about a property.

Know where that information goes, who can access it and how long it needs to be kept.

Australian guidance recommends collecting only the personal data needed to operate the business, restricting access and setting retention policies that reflect business needs and legal obligations.

Avoid adding form fields simply because the software makes it easy. Each field should have a purpose.

Prepare before something goes wrong

Write down a short incident response plan covering:

• Who receives and investigates a report.

• Who can contain the problem and coordinate recovery.

• How customers can contact the business during an outage.

• Who decides what needs to be communicated or reported.

• How the team checks that normal service has returned.

Australian guidance recommends defining responsibilities and testing the plan.

If you suspect an active compromise, contact your hosting or website provider promptly and involve a qualified cyber security professional when needed. Follow a structured containment and recovery process, including checking that the cause has been addressed.

If customer information may be affected, assess the relevant notification obligations with appropriate advice.

What should you do first?

Start with three questions:

Who controls the website? When was recovery last tested? Who acts when a problem is reported?

If you cannot answer them, identify the owner of each task this week.

Then review administrator access, important updates and the route from customer discovery to enquiry.

These checks address specific weaknesses. No single plugin, certificate or maintenance package eliminates every risk.

How Rewaver can help

Rewaver’s website care service includes hosting, daily backups, software updates, security monitoring and uptime monitoring.

For Australian trade and service businesses, maintaining those foundations helps keep the website available and the enquiry process working.

Start by discussing your current setup and the support you need. Confirm maintenance, recovery assistance and any specialist security work separately.

Talk to Rewaver about your website maintenance needs.

Frequently asked questions

What does website security for small business include?

It includes protecting access, maintaining software, securing connections, monitoring changes and preparing for recovery. The priorities depend on the website and the information it handles.

Does an SSL certificate prevent a website from being hacked?

A valid certificate enables HTTPS encryption. Account security, software vulnerabilities and harmful content require other protections.

Are daily backups enough?

They are useful, but you also need to know what is included, how copies are protected and whether restoration works. Match the backup schedule to how often important data changes.

Can a small website still be targeted?

Yes. Australian guidance recognizes risks to small businesses. Limited size does not remove the need to protect accounts, software and customer information.