The Security Holes We Keep Finding in Business Websites (And How We Close Them)

Here's an uncomfortable truth from our side of the table: most websites and apps we're asked to look at already have at least one serious security hole. Not because the owners were careless. Usually the site was built, launched, and then quietly left alone while the internet around it kept changing.

Attackers know this. They aren't sitting in a dark room writing clever exploits just for your shop. They run automated scanners across millions of sites at once, looking for the same handful of mistakes. If your site has one of them, it will be found. The only question is when.

This is no longer someone else's problem

For a long time, "data breach" sounded like something that happened to big American companies. Not anymore.

In March 2026, retail chain Shwapno confirmed that hackers had taken its customer database: names, phone numbers and purchase histories of around 40 lakh registered customers. The attackers demanded $1.5 million. Shwapno refused to pay and brought in forensic experts and the police's Counter Terrorism and Transnational Crime unit (The Daily Star, TBS News). Its managing director put it bluntly to reporters: “When I checked the leaked database, I entered my wife's phone number and immediately found her record.”

In August, a group calling itself "madarax" claimed on a dark web forum to be selling six million jobseeker CVs from Bdjobs, the kind of records that include addresses, education and employment history. Bdjobs called the reports misleading and false, and the claim hasn't been independently verified (The Daily Star). In September, a seller claimed to have 4.2 million records from e-commerce platform Ghorer Bazar. The company says its customer data is secure and that it has found no evidence of a breach (Daily Times of Bangladesh).

We don't know what happened inside any of these companies, and two of these cases are still only claims. This isn't about pointing fingers. The point is simpler: Bangladeshi businesses of every size are now on attackers' radar, and the data your customers trust you with (phone numbers, addresses, order history) is worth real money to someone.

We covered the wider threat landscape in our cybersecurity overview. This post is more hands-on. These are the holes we keep finding, in plain language, and what we do to close them for our clients.

1. Software nobody has updated in years

This is the big one. A WordPress plugin last updated in 2021. A Laravel or Node.js project still running packages with known, published vulnerabilities. Once a weakness is public, ready-made attack scripts usually follow within days, and bots start trying them on every site they can find.

What we do: list every component the site depends on, check each one against public vulnerability databases, then update or replace the risky ones. We test as we go, so the update doesn't break your checkout page. After that, alerts are set up so the next problem doesn't sit unnoticed for three years.

2. Files that were never meant to be public

A .env file with the database password in it. A .git folder that lets anyone download your entire source code. A backup.zip someone left in the web root "just for a minute" two years ago. We check for these first, because they're the fastest way for a stranger to take over a site. No hacking skill required, just a browser.

What we do: remove them, block those paths at the server level, and change every password or key that might have been exposed. Deleting the file isn't enough if the secret inside it already leaked.

3. Passwords and API keys sitting in the code

Payment gateway keys, SMS API tokens, email passwords. Hardcoded into source files or, worse, into JavaScript that gets sent to every visitor's browser. Anyone who opens developer tools can read them.

What we do: move secrets into server-side configuration where visitors can't see them. We scan the project's git history too, because a key that was "removed" in a later change is still sitting in the history for anyone with the repository. On the projects we build, a secret scanner runs on every commit and blocks it if a key slips in.

4. Forms that trust whatever you type

Search boxes, login forms, contact forms. If the code takes what a visitor types and drops it straight into a database query or onto a page, that's how SQL injection and cross-site scripting happen. These bugs are decades old, and we still find them, especially in older custom PHP code.

What we do: parameterised queries or a proper ORM everywhere, escaping on everything that's displayed, validation on the server (not just in the browser), and rate limits on login and contact forms so bots can't hammer them all night.

5. Weak doors: admin panels, default logins, no 2FA

/wp-admin with the username "admin". A hosting control panel with the same password as the owner's Facebook. A domain registrar account without two-factor authentication. Lose control of that last one and someone can take your whole domain, website and email.

What we do: unique strong passwords, two-factor login on everything that supports it (hosting, domain, admin panels, email), and a short list of who actually needs access. Former employees and the agency from three years ago get removed.

6. Missing security headers and half-done HTTPS

The padlock in the address bar isn't the whole story. Without headers like Content-Security-Policy, HSTS and X-Frame-Options, a site is easier to hijack with injected scripts or to embed inside a fake page. Cookies without the right flags can leak login sessions.

What we do: configure the headers, force HTTPS properly, tighten cookie settings, and check that nothing on the site breaks along the way.

7. No backups, or backups nobody has ever tested

Strictly speaking, this isn't a vulnerability. But it decides whether an attack costs you an afternoon or your business. Plenty of owners are sure they have backups, right up until the day they need one.

What we do: automatic off-site backups and a real restore test, so "we have backups" is a fact and not a hope.

How we work with clients on security

Security isn't a product you buy once and forget. For us it's part of how we build and look after software:

• Audit first, safely. We start with checks that only look, never touch: exposed files, outdated components, headers, HTTPS, leaked secrets. Nothing that could disturb a live site. Anything more aggressive happens on a staging copy, never on production.
• Fix by priority. You get a plain-language report sorted by what actually matters: what to fix today, this week and this month. Not an 80-page PDF of jargon.
• Build it in, don't bolt it on. On the projects we build, every change is code-reviewed, database access goes through safe query builders, and secrets never live in the code.
• Keep watching. Dependency alerts, uptime checks and regular re-audits, because new vulnerabilities get published every week.

What this means for your business

Done right, security work is pretty boring to watch, and that's the point. The online shop keeps taking orders. Customer data stays where it belongs. The clinic's booking system doesn't start redirecting patients to a gambling site. Google doesn't put a "this site may be hacked" warning on the search results it took you months to earn.

It also changes conversations. When a bigger client or a foreign partner asks how you protect their data, you have a real answer. And after this year's headlines, more of them are asking.

A five-minute check you can do today

• Log into your hosting, domain and admin accounts and turn on two-factor authentication wherever it's offered.
• Find out when your site's plugins, theme or framework were last updated.
• Ask whoever manages your site: "When did we last actually restore from a backup?"
• Remove accounts for people who no longer work with you.

If any of those answers make you uneasy, get in touch. We're based in Saidpur and work with businesses across Rangpur division, the rest of Bangladesh and abroad. The first consultation is free, and you'll get an honest answer, even if that answer is "you're in good shape."