Website security in the age of AI: why an unmaintained website is now a liability

Maybe your website was built a few years ago. It still loads, still brings in the odd enquiry and nobody has really touched it since. The site may not have changed, but the risk around it has.

Attacks on websites are faster, cheaper and more automated than they were when most small business sites were built, and AI is part of the reason. A website nobody is looking after is now the easiest kind to find and break into.

We've built on WordPress for years, and our view is that every business website should now be on one of three paths. Move to a managed platform that handles security for you. Keep your current site, but lock it down and maintain it properly. Or take the content management system (CMS) away altogether, which is what we'd strongly suggest for a site that hasn't been actively managed for several years.

What has changed in the last few years

There are far more known weaknesses in website software than there were, and attackers use them sooner.

Patchstack, which tracks security flaws in WordPress and its plugins, recorded 5,948 new vulnerabilities in 2023, 7,966 in 2024 and 11,334 in 2025. In 2025, 46% of them had no fix available when they were made public.

Across all software, the number of publicly catalogued vulnerabilities (known as CVEs) went from about 25,000 in 2022 to more than 48,000 in 2025, according to Jerry Gamblin's review of the CVE data. Part of that rise comes from more organisations reporting flaws, so it doesn't mean software got twice as bad. It does mean attackers have nearly twice as much to work with.

The timing has shifted too. Google's Mandiant team, which investigates serious breaches, estimates the average time to exploit a vulnerability in 2025 was minus seven days. In other words, attacks were routinely starting before a fix had even been released. VulnCheck found that nearly 29% of the vulnerabilities known to be exploited in 2025 were attacked on or before the day they were published.

Closer to home, the Australian Signals Directorate (ASD) received 84,700 cybercrime reports in 2024-25, about one every six minutes. The Office of the Australian Information Commissioner (OAIC) received a record 1,205 data breach notifications in 2025 and named cyber hacking as the main cause.

Where AI fits in

This is easy to overstate, so start with the careful version. Mandiant's M-Trends 2026 report says 2025 was not the year breaches became the direct result of AI, and that "the vast majority of successful intrusions still stem from fundamental human and systemic failures". Unpatched software, weak passwords and forgotten admin accounts are still how most attackers get in.

What AI changes is how quickly, how widely and how cheaply those failures get found. The ASD's latest Annual Cyber Threat Report assessed that AI "almost certainly enables malicious cyber actors to execute attacks on a larger scale and at a faster rate". The cases reported so far bear that out:

• In November 2025, Anthropic reported disrupting an espionage campaign in which attackers used its Claude model to carry out an estimated 80 to 90% of the work against around 30 targets. It succeeded in a small number of cases.
• In August 2025, Anthropic described a criminal with only basic coding skills using AI to build ransomware, then selling it to others for US$400 to US$1,200.
• Google's threat intelligence group reported in November 2025 its first sighting of malware querying an AI model during live attacks.
• In its 2025 Digital Defense Report, Microsoft said AI-enhanced phishing emails had a 54% click rate, about four and a half times that of conventional phishing.

AI is also getting very good at finding bugs in old code. The php2shell flaws we wrote about last week were found partly by OpenAI's Codex Security team. In April 2026, Anthropic said an unreleased model had found thousands of previously unknown vulnerabilities, including one in the OpenBSD operating system that had gone unnoticed for 27 years. And in July, when two flaws in WordPress itself were patched, honeypots recorded tens of thousands of attempts to exploit them. Security researchers told The Register there was "a very good chance" the attackers had help from AI.

For a site that gets patched promptly, most of this is manageable, because the same tools help the people writing fixes. For a site nobody patches, it means its weaknesses get found sooner, by more people, for less effort.

"We're too small to be a target"

Most attacks on small business websites aren't personal. Imperva's 2025 Bad Bot Report found automated traffic made up 51% of all web traffic in 2024, and bad bots alone accounted for 37%. Those scanners don't choose you. They work through the internet looking for any site running software with a known hole.

Being found has a price. The ASD puts the average self-reported cost of a cybercrime at $56,600 for a small business and $97,200 for a medium one.

WordPress, and why we're rethinking the default

We still like WordPress. It's accessible for the people who edit their own sites, there's a plugin for almost anything and it's cheap to build and run. W3Techs says it powers 39.6% of all websites.

That extensibility is also where the risk sits. Patchstack found 91% of the WordPress vulnerabilities reported in 2025 were in plugins, and counted 1,614 plugins and themes removed from the official WordPress directory in 2024 because of unpatched security issues. Every plugin on your site is another piece of software someone has to keep current. WordPress core has a strong record, but July showed it isn't immune.

php2shell added another layer. The flaw sat in PHP, the language WordPress runs on, so a site with every plugin updated could still be exposed if nobody had patched the server.

So more and more, we're looking at technical setups with less to defend. With Shopify, or a site built in Next.js with its content managed in Sanity, the admin login and database are run and patched by the platform, away from your public website. That removes a lot of the ongoing security work before it starts.

Path 1: move to a managed platform

If your site is mostly a brochure, a booking page or a simple shop, a managed platform like Squarespace, Shopify or Wix deserves a serious look. They run and patch their own servers, so there's no PHP version for you to check and nothing on the server for you to update.

They also take on most of the payment security. Shopify says it is certified Level 1 PCI DSS compliant, the top level of the card industry's security standard. Wix holds PCI DSS Level 1 as well. Squarespace says its built-in payment integrations are PCI DSS compliant and that it never handles card data itself.

You still own your logins (turn on two-factor authentication), any third-party apps you add and who on your team has access. The trade-off is flexibility: you work within the platform's features, and moving off it later can be a project of its own. We compare the three in Wix vs Squarespace vs WordPress.

Path 2: keep WordPress, but lock it down

For a custom site with integrations, memberships, a complex WooCommerce shop or bespoke features, a managed platform often isn't a realistic swap. Then the answer is to run WordPress properly:

1. Make someone responsible for every layer: plugins and themes, WordPress itself, PHP and the server. Plugin updates show up in the dashboard. Server patches don't.
2. Cut the plugin list. Remove anything inactive, abandoned or doing the same job as another plugin.
3. Turn on two-factor authentication for every admin account, and delete the ones nobody uses.
4. Put a web application firewall in front of the site, through Cloudflare or your host. It buys time between a flaw going public and the fix going on.
5. Keep backups off the server, and restore one at least once so you know they work.
6. Monitor the site for downtime, admin users you didn't create and unexpected file changes.

That's the work a website support and maintenance plan covers. If you're unsure what different arrangements include, Website service types explains the difference between support, maintenance and hosting.

It's also worth asking whether a custom site still belongs on WordPress. If it has outgrown it, planning a migration while the site still works is far easier than doing it in a hurry after an incident.

Path 3: ask whether you need a CMS at all

A CMS earns its keep when you edit your site often: weekly news, events, a product range that keeps changing. Plenty of business websites change a few times a year. If that's yours, the login page, database and plugins that make editing possible are risk you carry for a feature you barely use.

The alternative is a static website. It has the same design and content, published as plain files. With no admin login, no database and no plugins on the live site, most of the website attacks described above have nothing to aim at. Static sites also load quickly, because there's nothing to assemble when someone visits, and that matters most on phones (we cover why in 8 ways to improve mobile website performance).

The main trade-off is that you lose the ability to log in and change content yourself whenever you like. Edits go through a developer instead, which suits a site that rarely changes and frustrates one that changes every week. Static isn't invulnerable either. Contact forms, third-party scripts and the accounts that control your domain and hosting still need care.

The Australian Cyber Security Centre's guidance for small businesses on AI-enabled attacks points the same way, recommending you turn off websites and features you don't need.

If your site hasn't been actively managed for several years, this is the path we'd look at first. Rebuilding a small site as static files is often less work than safely catching up on years of missed WordPress, plugin and PHP updates. You also end up with a faster site that has far less to maintain.

Which path fits your website

Not sure where your website sits? We can look at it and tell you which path makes sense and what it would involve.