Security for Non-Security People

This year, host Bryan Mills has cleaned up multiple hacked WordPress sites, including one where a single outdated plugin handed the attacker a file manager: open any file, write straight to the database. Here's what the attacker knew about that organization before striking: nothing. A bot read a version number, and that was the whole crime. This episode is security with no dread and no jargon: four ordinary enemies, one afternoon of defenses, and a calm script for the bad day the defenses make unlikely. Bryan names the four attacks small sites actually face, brute force, malware through outdated software, AI-quality phishing, and form spam, and, just as usefully, the exotic threats you have permission to ignore. Then the baseline, nearly all of it free: the update schedule as the highest-value security control you hold, unique vaulted passwords, two-factor authentication on every account that could cause an incident, the one habit that defeats phishing even when the fake is perfect (never log in through a link in a message), and least privilege, including why publishing should never happen from an account that can delete the site. Then the walls and alarms, tuned rare enough to matter, and the hour-by-hour incident script with a tested backup at its center. On the Question Line: a board chair says, "We're a tiny nonprofit; nobody is going to bother hacking us," and we hand you the two-minute answer that wins the room. In the Tool Minute: Have I Been Pwned, the free breach check that makes the whole argument concrete in ninety seconds. Quick win: count your CMS administrator accounts, demote or delete the extras, and turn on 2FA for the rest. In This Episode The four enemies: brute force, malware via update gaps, industrialized phishing, and form spam, plus the anatomy of a real small-site compromise Scope discipline as a security practice: the exotic threats to ignore, and the one setting that retires form spam for the year The baseline cost question: what would it cost to send the email that begins "We are writing to let you know about a security incident"? The phishing habit that survives perfect fakes, and the no-blame reporting norm that turns clicks into early warnings Least privilege in practice: never fewer than two admins, no shared logins anywhere, and offboarding as a security event Walls and alarms: two free layers, three settings, and the alert-fatigue tuning that keeps the rare message loud The incident script: confirm, contain, rotate, restore onto an updated platform, and write the log entry that closes the loop Myth busted: "we're too small to be a target" The Question Line: the board chair's objection, answered in two minutes (send yours in via the link below) The Tool Minute: Have I Been Pwned Links This episode's worksheet, the Security Baseline Checklist and Incident Response One-Pager: https://webmanagers.com/register Episode page (full notes, worksheet, and transcript): https://webmanagers.com/podcast/security-for-non-security-people Capthca: Cap https://trycap.dev/ | hCapthca | Google reCAPTHCA Have I Been Pwned: haveibeenpwned.com The book, Strategic Web Management: First Steps for the Accidental Web Manager: Companion site and all free worksheets: https://webmanagers.com/register Follow the show: https://webmanagers.com/podcast Leave a rating and review: Apple Podcasts | Spotify URL | Other Channels Ask a question for a future episode: https://webmanagers.com/podcast Timestamps 0:00 The bot that read a version number 1:40 What this episode covers 3:00 The Shift: automated, indiscriminate, and phishing without the tells 4:50 The four enemies, and the threats you may ignore 7:15 Anatomy of a small-site compromise 8:25 The baseline: updates, credentials, 2FA, and the phishing habit 10:55 Least privilege and the offboarding checklist 12:10 Walls and alarms: two free layers, tuned rare 14:25 The day you get hacked: the calm script 17:25 Myth busted: "we're too small to be a target" 18:25 The Question Line: the board chair's objection 20:55 The Tool Minute: Have I Been Pwned 22:10 Quick win: the administrator audit 23:10 Worksheet and where to find it 24:05 Close and Episode 10 tease