Over the past few months we ran a passive website security check on 214 Hong Kong business websites. Passive means we only looked at what is already public, the same things any stranger with a laptop can see. What struck us was not how clever attackers are. It was how repetitive the problems are. The same handful of mistakes turned up again and again, on restaurant groups, clinics, freight forwarders and shops that have traded for twenty years. Almost none are exotic, and most could be fixed in an afternoon by whoever already looks after your site.
What 214 Hong Kong websites actually looked like
We score every site from 0 to 100, where 0 means nothing useful is visible from outside and 100 means wide open. The average across our own scan of 214 Hong Kong business websites was 41. Seventy-two per cent had at least one finding we rate as high or critical.
That is not because Hong Kong business owners are careless. It is because these settings are invisible. Nothing breaks when they are wrong. Your website still loads and your email still sends. The gap only becomes visible on the day somebody uses it.
Meanwhile, cyber security in Hong Kong is getting busier, not quieter. HKCERT handled 12,536 security incidents in 2024, the highest figure in five years. Roughly 62 per cent were phishing, more than double the year before. Little of that is aimed at banks. Most of it lands on ordinary businesses, because they are easier.
The most common failure: anyone can send email pretending to be you
This was the single biggest pattern in our data. Sixty-eight per cent of the sites had no DKIM record, 62 per cent had no DMARC, and 35 per cent had no SPF.
Those names sound technical, but the idea is simple. They are small entries in your domain settings that work like a company chop on a letter. They let the receiving mail server check that an email claiming to come from your company really did leave your office. Without them there is nothing to check. Anyone can send an email that displays as accounts@yourcompany.com.hk, and it arrives looking perfectly normal.
What that means in practice: a client receives an invoice from your address with the bank details changed, pays it, and nobody notices for a month. Or a staff member gets an urgent instruction from the boss's address. IBM has noted that AI can now draft a convincing phishing email in about five minutes, against roughly sixteen hours by hand, so the volume of these attempts is rising fast.
There is a quieter cost too. Without these records, your own genuine email is more likely to land in customers' spam folders.
What to do: ask whoever manages your domain to add SPF, DKIM and DMARC. Start DMARC in monitoring mode so nothing breaks on day one, then tighten it once you can see your own mail flowing correctly. Usually under an hour of work, and it costs nothing.
Website software that quietly stopped being updated
Most small Hong Kong business sites run WordPress with a few plugins bolted on: a booking form, a photo gallery, a chat widget, a language switcher. Each is software written by someone else. When a flaw is found in one of them it gets published openly, and within days automated tools are scanning the whole internet for sites still running the old version. Nobody picks you out. You simply match the pattern.
We regularly find sites two or three years behind. The usual outcome is not dramatic. It is your site quietly serving spam pages, or redirecting mobile visitors to a gambling site, until Google flags your domain and your enquiries dry up. Verizon's 2024 breach report found that 88 per cent of small business breaches involve ransomware or extortion, and outdated website software is one of the easiest doors in.
What to do: switch on automatic updates for minor versions, review your plugin list once a quarter, and delete anything you no longer use. Deactivated is not deleted. A dormant plugin still sits on the server and can still be attacked.
Missing headers, and a padlock that quietly expired
Security headers are short instructions your website sends to each visitor's browser. Things like "always connect to me over an encrypted link" or "do not let another site display my pages inside a frame". They are free, they change nothing a customer can see, and a large share of the sites we scanned had none of them. Without them it is far easier for someone to build a convincing fake overlay of your booking or payment page.
The padlock is the other one. That padlock in the address bar comes from a TLS certificate, and certificates expire, often every ninety days now. If automatic renewal fails and nobody is watching, visitors get a full-page red warning saying your site is not safe. That is a lost-bookings problem before it is a security problem. We also still find sites accepting old, broken encryption settings that were retired years ago.
What to do: ask your host to confirm certificate auto renewal is on, and put the expiry date in your calendar as a backstop. Your host can normally switch the headers on for you.
Files left in the open, and your name in the public register
Two smaller findings, both easy to fix.
The first is exposed files. Old backups, database exports, configuration files with passwords in them, a leftover /test or /old folder from the last redesign. Nobody links to these, so owners assume nobody can find them. Automated scanners guess common filenames all day long, and one forgotten backup can hold your entire customer list.
The second is personal information in public records. Seventeen per cent of the domains we scanned publish the owner's own name, and often a personal phone number or home address, in the public WHOIS register. Anyone can look that up in seconds. It is exactly what someone needs to write a believable email to your staff, or to ring your registrar pretending to be you.
What to do: ask your host to move backups out of the public web folder, and turn on WHOIS privacy with your registrar. The second usually costs nothing or a few dollars a year.
What to do this week, and where to start
None of this needs a security team. 資訊保安 for a small business is mostly a short list of unglamorous checks that nobody has been asked to do.
- Ask whoever manages your domain whether you have SPF, DKIM and DMARC. If the reply is "what are those", you do not.
- Log in to your website admin and check when it was last updated. Delete plugins you no longer use.
- Confirm your certificate renews automatically, and note the expiry date somewhere.
- Ask your host to confirm no backup or database files sit in the public web folder.
- Look up your own domain on any WHOIS lookup site. If your personal details are showing, switch on privacy.
- Tell whoever handles payments that any change of bank details arriving by email gets confirmed by phone, on a number you already had.
In Hong Kong, 網絡安全 still gets discussed as a big-company subject, which is why the basics go unattended at the smaller end. The problems we found were not sophisticated attacks. They were settings nobody had been asked to look at.
Everything above is visible to an outsider without your permission, which means you can see it too. If you would rather see your own list in writing, we will run the same passive website security check on your domain and send you the report, free and with no obligation.