In May 2024, Europol coordinated the largest operation in history against botnets: more than 800 servers seized across 17 countries, dismantling infrastructure that had infected millions of devices. Most of those servers didn’t belong to criminal organisations. They were shared hosting servers where completely ordinary companies’ websites lived alongside things they had no idea about.
If your corporate website sits on a low-cost shared hosting plan, that’s your situation today. Not theoretically. Currently.
The debate about cybersecurity in B2B companies concentrates in the wrong place: firewalls, antivirus, strong passwords. All of that matters. But the most frequent risk vector for a corporate website isn’t a targeted attack on your company. It’s the infrastructure that site lives on.
The problem nobody explains: shared hosting as systemic risk
When a company buys an “economical” hosting plan — the ones starting at three or four dollars a month — its website shares a physical server with hundreds of other sites. That includes online shops of dubious provenance, sites abandoned years ago, unmaintained personal projects and, with a certain statistical frequency, sites that have already been compromised by malware.
The problem isn’t digital proximity in the abstract. It’s concrete: when a neighbouring site on that server is infected and the hosting provider doesn’t detect it in time, the malware can spread laterally. Search engines like Google detect this at the server IP level. If several sites on that IP are flagged as malicious, every site on it can receive browser security warnings, land on blacklists, or lose rankings abruptly.
In 2023, the PTW team documented the case of an industrial services company whose site was flagged as “dangerous” in Chrome for 11 days. The company hadn’t been hacked directly. A site on the same shared server was infected with phishing, and the IP was blacklisted. The company’s corporate site was simply in the wrong place. The cost wasn’t only reputational: for those 11 days, any prospect trying to reach it from Chrome saw a red warning screen before the site.
Hosting isn’t just a technical commodity
The market tends to treat it as though it were. The usual buying criteria are price and disk space. That makes sense for a personal blog or a pilot project. It makes no sense for the website of a company that uses that domain in its commercial proposals, in its email signature, and as the first point of validation when a prospect investigates before a meeting.
A B2B corporate site has a specific function: building credibility and giving enough information for a prospect to confirm the conversation is worth continuing. If that site is down, slow or flagged as insecure at the precise moment someone checks it, the damage appears in no report. There simply isn’t a meeting.
How to assess your site’s real security
The good news is that there are clear signals any manager can check without deep technical knowledge. The basic protocol requires hiring nobody.
Initial diagnostic checklist for B2B companies:
-
Check the SSL certificate. Visit your site in Chrome or Firefox. Do you see a padlock in the address bar? Click it. Is the certificate current and in your domain’s name? An expired SSL isn’t only a security risk — it’s a visible signal of carelessness to any visitor.
-
Verify what type of hosting you have. Check the contract or ask whoever administers the site. Is it shared hosting, VPS or a dedicated server? Shared is the riskiest for an active corporate site. A VPS (virtual private server) already offers significant isolation.
-
Check your IP’s history. Tools like MXToolbox or Google Safe Browsing (transparencyreport.google.com) let you verify whether your domain or IP appears on blacklists. It’s free and takes two minutes.
-
Check when the CMS was last updated. If your site runs on WordPress, Joomla or another content manager, an out-of-date version is the main entry point for automated attacks. Bots don’t look for specific companies — they scan the internet for known vulnerable versions.
-
Confirm who has administrative access. Are there former employees or former agencies with active credentials? Is the admin user called “admin”? Are passwords changed periodically?
-
Ask about the backups. How often is the site backed up? Where is that backup stored? If the answer is “I don’t know” or “on the same server”, there’s a problem.
What distinguishes adequate hosting for a B2B company
This isn’t about paying more for marketing. It’s about understanding which technical characteristics actually reduce risk.
A hosting provider adequate for a B2B corporate site should offer, at minimum: account isolation (so what happens on other sites on the server doesn’t affect yours), active malware monitoring with alerts, daily automatic backups in a separate location, technical support with a defined response time, and a written uptime guarantee (ideally 99.9% or higher).
There are local and international providers meeting these standards. The criterion isn’t the brand — it’s checking that the contract specifies these conditions explicitly. If the contract mentions none of it, the provider has no obligation to deliver it.
The argument that settles the internal discussion
In many B2B companies, the hosting conversation ends in admin or IT with a simple argument: “it’s working, let’s not touch anything”. It’s an understandable argument. It’s also incomplete.
“It’s working” describes the state of the site today, at this moment, when nobody is attacking it. It doesn’t describe its resilience to an incident. And web security incidents don’t give notice.
The cost of remediating a compromised site — cleaning malware, getting off blacklists, recovering lost rankings, managing the communication with clients who saw the warning — comfortably exceeds the annual cost of being on adequate infrastructure from the start. A blacklist recovery process with Google can take between two weeks and two months, depending on the severity and the speed of response.
There’s another argument few companies consider: the impact on technical SEO. Google has used HTTPS as a ranking signal since 2014. More importantly: if your site appears on security blacklists, the impact on domain authority can take months to reverse, even after the technical problem is solved. A site with five years of accumulated SEO work can lose significant positions over a security incident that lasted days.
The responsibility sitting with whoever administers the site
A point that frequently causes confusion: many companies assume site security is the hosting provider’s exclusive responsibility. Legally and practically, it doesn’t work that way.
The hosting provider is responsible for the infrastructure. Application security — the CMS, the plugins, the site code, the access credentials — is the responsibility of whoever administers the site. If WordPress is out of date, that isn’t a server problem. It’s a management problem.
This means good hosting solves part of the problem. The other part requires active maintenance: periodic updates, access review, performance monitoring and verified backups. It isn’t a one-off task — it’s a continuous practice.
In B2B companies where the site was built two or three years ago and nobody has reviewed it technically since, both problems usually coexist: inadequate infrastructure and an out-of-date application. That combination turns a corporate site into an easy target for automated attacks that aren’t looking for your company in particular — they simply find the door open.
If reviewing this checklist turned up more than two points without a clear answer, your company’s site has real exposure. The logical next step is a diagnostic covering both the technical base and the infrastructure: PTW’s digital diagnostic. It isn’t an alarmist audit — it’s understanding exactly what state your digital asset is in, before the problem defines it for you.