Nobody Breaks Into a Pest Control Site Through the Platform

A text landed while I was eating lunch in the truck, from a pest control owner I’ve known for years:

“Patrick. Got an email this morning saying my WordPress is out of date and I’m one bad click from being hacked. They want four figures to move me somewhere secure. Is this real or is it garbage?”

Mike runs three trucks and does his own scheduling, and he’d pasted the whole email underneath the message.

I read it twice, because parts of it were true, and those are the ones I want to deal with first.

An untended website really does get broken into. I’ve had that call, and it’s a bad one, because you don’t find out from a warning light. You find out from a customer.

A client of mine had her homepage quietly replaced overnight with a page selling handbags, and it sat there for a day and a half before anyone thought to look.

So I’m not going to tell Mike the email is a lie.

I’m going to tell him it isn’t about him.

Where the number comes from

I know what this trade runs on because I spent an evening working out what every one of these sites was built with: 46.1% of the pest control websites I audited are built on WordPress, against 36.4% of small business sites in general.

Put the trades side by side on overall score and pest control lands at 76 out of 100, 4 of 47 industries I scored, which is not what a trade in danger looks like.

WordPress is the most common answer here by a distance. If it carried the risk the email says it does, this trade would be a smoking hole by now, and it plainly isn’t.

What the sender actually knows about you

Working out that a site runs WordPress from the outside is not detective work. I do it myself, with a script, and I did it across 1,177 pest control websites without speaking to a single owner or logging into anything.

So the email didn’t find Mike. It found a fingerprint, on a list, along with a few thousand others that morning.

The sender knows one fact about his business, which is the same fact I know, and neither of us has any idea whether his site is looked after or abandoned.

Would you quote a termite job on a house you’d only ever seen from the road?

You wouldn’t, and you’d have some choice words for anyone who did. Yet that’s the exact shape of the thing sitting in his inbox, and it’s selling him a rebuild.

Every one of those emails gets written before it knows who it’s going to, which is the difference between an inspection and an advertisement dressed up as one. Yours arrived off a list, and so did the identical one your competitor two towns over deleted on Tuesday.

What actually gets people

The break-ins I’ve helped clean up had nothing to do with the name of the software.

Rick’s booking form ran on a plugin, which is a small add-on you bolt onto a site to make it do something it doesn’t do by itself, and his hadn’t been updated in three years because the fellow who installed it stopped answering emails in the spring of the first one.

That’s how they got in. Not through WordPress. Through a door someone else hung and nobody ever checked. I once counted the add-ons on a food rescue charity’s homepage and found eleven of them propping up one donate button, every one of them a door.

Sherry’s was worse and simpler. She had no backup, meaning no copy of the whole site sitting somewhere else, taken last night and the night before that, and she’d been paying a hosting bill for six years without ever being handed one. Nightly copies are part of what you are supposed to be getting for a hosting bill, and hardly anyone reads the list before they sign up.

The break-in cost her a morning. The missing copy cost her the site.

So when I look at a pest control website now, the platform is about the fourth thing I get around to, and honestly some weeks I never do.

Moving doesn’t fix the thing he’s afraid of

Say Mike pays. He gets a new site on a platform with a different name, and for about eleven months it’s lovely and nothing goes wrong at all.

Then it needs updating too, because everything does, and the question underneath it is the same question it always was. Who logs in, and when did they last bother?

If nobody can answer that today, the rebuild buys him a nicer version of the same problem, on a longer contract. Hair salons get sold the same move for the same reasons, and no piece of software has ever booked one of them an appointment.

And you’d be spending the money for that move out of the same pocket that could keep someone tending the site you’ve already got, for years, which is a comparison the email is careful never to put in front of you. Given a small budget for a pest control website, I’d spend it in a completely different order, and a rebuild is nowhere on that list.

And none of it moves a thing I score. The ten checks behind my numbers never ask what your site is built with, because the woman standing in her garage at nine at night with a flashlight doesn’t ask either.

She wants to know if you do rats, whether you come out on Saturday, and what it’s going to cost her.

The mix, since everyone assumes it’s a two horse race

While I was in there I kept reading past the top two, and GoDaddy turns up on 4.6% of these sites with Wix on 4.1%, so the trade is scattered across more tools than the sales emails imply.

Nothing on that list is exclusive. One site can leave two of those fingerprints at once, and plenty leave none my script can read.

And you landed on WordPress the same way most people land anywhere, which is that a builder you hired in a year you can barely remember made the choice on your behalf and then moved on with his life.

That’s not a decision you need to defend. It’s just where you live.

What I told Mike

Three questions, and not one of them is about the platform.

1. Who has the login, and does that person still work with you?

2. When was the last backup taken, and has anybody ever restored one to check it works?

3. Is there a person whose job it is to press update, or does updating happen when something breaks?

If he can answer all three, he doesn’t need to move, and the email goes in the bin where it belongs.

If he can’t, moving won’t save him, because the new site asks the same three questions by Christmas. That’s why those three answers are the first thing I settle when I take on a pest control site, before anyone says a word about colors.

Who I didn’t write this for

Not the owner whose site has been down since March and whose builder stopped answering the phone in February. Move. Move this week, and don’t ask me what to move onto, because anything with a person behind it beats what you’ve got.

Not the owner who has never had a website at all. You’re not choosing between platforms, you’re choosing between something and nothing, and you’d win that argument faster than you think.

And not the fellow who emailed Mike, though I do hope he reads it.

Everyone else, the ones with a WordPress site that works fine and a scary email in the inbox: nothing is wrong with your software. Go and find out who has the login.