What cybercrime costs a small business
The Australian Signals Directorate (ASD) received more than 84,700 cybercrime reports in 2024-25, about one every six minutes. For small businesses the average self-reported cost per report was $56,600, up 14%. These figures come from the ASD Annual Cyber Threat Report 2024-25.
ASD also sets patching deadlines. Patching means applying a security fix. At Maturity Level One, its Essential Eight Maturity Model says to patch online services within 48 hours when a vulnerability is rated critical or a working exploit exists, and within two weeks otherwise.
Where WordPress sites get caught
Plugins are the add-ons a WordPress site uses. Patchstack’s State of WordPress Security in 2025 counted 7,966 new vulnerabilities in the WordPress ecosystem in 2024. Of those, 96% were in plugins, 4% in themes and seven in WordPress core. 43% needed no login to exploit, and 33% were not fixed before they were made public.
In the Sucuri 2023 Hacked Website Report, 39.1% of infected CMS (content management system) sites were running out-of-date software when cleaned. WordPress made up 95.5% of the infections Sucuri saw, and Sucuri notes its data is not the whole web.
Domains and Google
When a .au domain expires, the website and email stop working. auDA allows 30 calendar days in which it can still be renewed. After that it is removed and anyone can register it.
Google says Core Web Vitals are used by its ranking systems. A hacked site can be labelled “This site may be hacked” in results, or blocked behind a browser warning.
What this means for a site we build
CatalystHub builds on Astro with TinaCMS and hosts on Cloudflare, not WordPress, so a site we build has no WordPress plugins to patch.
It still has code dependencies to update, backups to keep, and uptime and speed to watch. The care plans include security and dependency updates, daily off-site backups, 24x7 uptime monitoring with alerts and a monthly Lighthouse and Core Web Vitals report.
You own the code, the domain and the hosting. See who owns your website.