Security as a trust signal

Security looks like a topic separate from marketing, until the day it is not. A site flagged as dangerous disappears from the results within hours and comes back within weeks. What you built over two years stops one morning.

What you actually lose

• The browser warning. The red screen that says “deceptive site”. Almost nobody gets past it, and those who do no longer buy.
• The label in Google results. Even if the page keeps its position, a warning appears under it.
• Email. A domain that has sent spam ends up on blacklists, and ordinary messages start landing in the junk folder. The effect lasts long after the cleanup.
• Getting back into the index. It is not automatic. You request it, it gets reviewed, and returning to the previous position usually takes weeks.

What a modern infection looks like

The image of the defaced page with a message from the attacker belongs to the past. Whoever breaks into a commercial site wants to stay unnoticed for as long as possible.

Why deleting what you find is not enough

Serious hosting providers have a scanner that detects infected files and neutralizes them. It is useful and insufficient, for a simple reason: the scanner cleans the effect, not the cause.

On tifui.ro we met the mild version of the same problem: the scanner had left behind half-emptied code fragments, enough to look clean and not enough to be clean.

It is worth saying what happens after the cleanup too, because it is almost always skipped. If the attacker was able to run code on the server, they were also able to read the configuration file, so the database password, the email passwords and the keys to external services. All of them must be changed, even if nothing seems to have been used. On limo-limousine.com that was the part left to do after the site was already working normally.

The certificate and what people see

Almost every site has a certificate today, so having one is no longer an advantage. Not having one, or letting it expire, remains very costly, because the browser does not say “this site has no certificate”, it shows a warning screen that most people read as “this site is dangerous”.

Certificates renew automatically almost everywhere. Renewal can fail silently, though, and the most common case is a DNS record deleted or changed by someone else. You will not get any message. You will get a phone call from a customer asking why they are seeing an alert.

That is why a monthly check, which takes ten seconds, is worth it: open the site and click the padlock in the address bar. It shows there how long it is valid for.

What we ask for, in order of usefulness

1. Everything up to date. Most infections use vulnerabilities for which a fix already existed, sometimes for months.
2. Different passwords and two-step authentication on the admin accounts. It is the measure with the best effort-to-effect ratio.
3. Limiting login attempts and disabling old interfaces you do not use. On tifui.ro, those two would have stopped over two thousand attempts from the start.
4. Backups you have tested. A backup you have never restored is an assumption, not a backup.
5. Fewer plugins. Each one adds attack surface. Unused ones get uninstalled, not deactivated.

If it happens

1. Do not delete anything yet. The modified files tell you where they got in, and deleting them destroys the only trace.
2. Make a copy of the current state, infection included, before any intervention.
3. Change all passwords: admin, hosting, database, email.
4. Find the entry point and close it, then clean up.
5. Request a review in Search Console, in the security issues section.
6. Watch the logs for a month. Whoever got in once will try again.