This is part four of our website security series, and if you have not read the first three, that is fine. Every post in this series covers different problems and different fixes, pulled from actual work we have done. No recycled advice, no generic checklists copied from somewhere else. Just specific issues we found on real sites and what we did about them.
Website security is not a one-time task you check off a list. It is ongoing work, because the threats keep changing and so do the weak points in how sites get built and maintained. Here are three more problems worth knowing about.
Outdated Plugins Left Running Long After They Stopped Being Updated
One of the most common issues we run into is plugins or add-ons that are still active on a website years after the developer stopped maintaining them. The site owner installed something useful at some point, it did its job, and then everyone forgot about it. Meanwhile the plugin has not received a security update in three or four years.
That is a problem because vulnerabilities get discovered in old software all the time, and if nobody is patching it, those holes just sit there open. Attackers actively scan the web looking for sites running known-vulnerable versions of popular plugins. It is not a targeted attack. It is automated and it is constant.
The fix is straightforward but requires actually doing it: audit every plugin and extension on the site, check when each one was last updated, and figure out if it is still maintained at all. If a plugin has not been touched in a couple of years, either find an actively maintained replacement or remove it entirely if it is not essential. Fewer moving parts means fewer doors left unlocked.
Admin Login Pages Sitting at the Default, Predictable URL
Here is a small thing that makes a bigger difference than people expect. A lot of website platforms put the admin login at the same predictable address by default. Anyone who wants to try to break in knows exactly where to go to start guessing passwords.
We found this on a site that had decent passwords in place but had never changed the login location. That meant it was getting hit constantly by automated bots trying username and password combinations, over and over, all day and all night. The passwords held up, but that kind of constant hammering slows down a server and increases the odds that something eventually gets through, especially if a password ever gets reused somewhere else and leaks.
The fix was to move the login page to a custom, non-default location and add a limit on failed login attempts so repeated guessing gets blocked automatically. Combined with two-factor authentication, this cut the automated attack traffic down to almost nothing. It is a simple change that takes the site off the list of easy targets.
Forms Collecting Customer Information Without Any Encryption in Transit
This one is worth taking seriously because it involves customer data directly. We found a site with a contact form, and in some cases a checkout or account form, that was submitting information without proper encryption in place. That means names, emails, sometimes even payment-adjacent details, were traveling across the internet in a way that could potentially be intercepted.
Customers trust a business with their information the moment they fill out a form. If that trust gets broken because basic protections were not in place, the damage goes beyond the technical fix. It costs reputation and it can create real legal exposure depending on the type of data involved.
The fix involved making sure every page with a form was served securely, confirming that certificates were configured correctly across the entire site rather than just the homepage, and double-checking that data was actually being encrypted properly on submission rather than just showing a lock icon in the browser. A lot of sites have security certificates installed but still have gaps on specific pages that never got checked. This is exactly the kind of thing that gets missed unless you go through every page one at a time.
The Pattern Behind All Three of These Fixes
What connects these three issues is that none of them were dramatic or complicated to explain. Nobody hacked in through some elaborate scheme. These were ordinary oversights: a plugin nobody thought to update, a login page nobody thought to move, a form nobody thought to double check. That is how most website security problems actually happen. Not through sophisticated attacks, but through small things that got overlooked and then sat there unaddressed for months or years.
The businesses running these sites were not careless. They were busy running a business, which is exactly why this kind of check tends to fall through the cracks. Nobody wakes up thinking about plugin update logs.
If any of this sounds like it could be true of your site and you are not sure, that is normal. Reach out to Level Up AI and we will take a look with you.