I Checked the Front Doors of 4,450 Ontario Small Businesses. Most Were Open.

Most weeks I am looking at the networks behind courthouses, water utilities, law enforcement, and the suppliers who build for defence. Big systems, long audits, rooms full of people whose job is to worry about this. Last week I turned the same eye on the other end of the street: the bakery, the law office with two lawyers, the HVAC company with a truck and a website a nephew built in 2017.

I did it because of a bug, and because it felt like the right time, and close to a public service.

On October 21 the PHP project shipped an emergency fix for two flaws, now nicknamed PHP2Shell, that let an attacker take over a web server without a password. PHP runs most of the web, so this is not a problem for someone else’s data centre. It is a problem for whoever runs the software behind the quote form on a local contractor’s site. Within days the United States cyber agency had it on the must-patch list, and Amazon said it had seen attempts before the bug was public.

So I asked a simple question. How exposed are the businesses in my own corner of Ontario, right now?

What I did, and what I did not do

This was not a public records search. I looked at the public-facing side of 4,450 small businesses across seven regions, London and Middlesex County, Sarnia-Lambton, Chatham-Kent, Kitchener-Waterloo, Cambridge, Brantford and Brant County, and Windsor-Essex, and checked for the things I would flag in one of my audits: how their email is set up, whether the software behind the website is current, whether the padlock works, and what their domains give away.

Every one of them runs a website on a domain of its own. Shops, trades, clinics, firms, and contractors. Not chains, and not government. Each was looked at from the outside, the way any visitor could: public DNS records and one visit to the home page. Nobody was hacked or scanned, and no business is named.

This is not name and shame. It is meant to draw attention to things we do not normally pay attention to.

What turned up

The headline, given why I started, is PHP. At least 149 of these local sites are advertising a PHP version that is either behind the PHP2Shell fix or on a release line that will never be patched. Read that as a floor, not a ceiling. Most sites hide their version, so the real number is higher.

The number that bothered me more was email. Of the 3,539 businesses that receive email, 2,942 can be impersonated. That is 83%. There is a DNS record called DMARC that tells Gmail and Outlook to throw away a message forging your address, and four of every five local businesses have not turned it on. That is how a fake invoice, with a real logo and a real signature, lands in a customer’s inbox looking exactly like it came from you. Invoice fraud almost always starts there.

The rest is a grab bag of small, fixable things:

• 442 domains have no SPF record at all, the most basic email check there is.
• 1,593 sites run WordPress. 206 of those that reveal a version are behind on security updates, and 229 sites still load a code library retired in 2016. 454 take card payments on that same software.
• 235 sites serve a broken, expired, or missing certificate.
• 359 domains that businesses are still listed under no longer work, and 132 more show a parking page. An abandoned domain can be re-registered by anyone, who then receives the mail meant for that business.

Every region has its own report with the breakdown by sector, by town, and by hosting platform, and the method and its limits spelled out. They are all on the State of Cyber Hygiene in Ontario hub, with a map.

The front door nobody has to drive to

When we talk about securing infrastructure, from courthouses to municipal water utilities, there are always holes. Something does not function the way it was intended or designed, something failed, or something was overlooked, on both the physical and the digital side. I see it all the time: a temporary fix becomes permanent, and that becomes the vulnerability. Small businesses are no different.

We look after the physical side without thinking about it. A broken door, a lock that does not latch, a camera someone has covered: we see those and fix them the same day. We are not always paying attention to the same things in the digital world, and the threats there are real, with real impact and real damages.

The biggest change in the last thirty years is that instead of a criminal needing to drive to your business, they can now reach it from the other side of the globe without getting out of their chair. We need to take the same steps on the digital side. At least put a lock on the front door. At least make sure the windows are closed. At the very least, make sure the front door is shut.

This is not a competence problem

I do not want anyone to take the wrong thing from this. These owners are not careless, and they are not foolish. They are busy running a business, and nobody ever sat them down and told them that an afternoon of free changes, to records they probably do not know they have, would close most of the gap. There is no villain here. There is a gap between what is normal and what is possible, and almost nobody told the people on the small end of it.

That gap is the whole reason the fixes are published next to the findings. Five changes close most of what I found, and none of them need new software:

1. Stop people sending email as you. Publish SPF, turn on DKIM, and set DMARC to quarantine or reject.
2. Patch the website platform, and hide its version. Keep WordPress, its plugins, and PHP current, and turn off the version numbers in the page and the headers.
3. Force HTTPS and keep it on. Redirect every visitor to the encrypted site and add an HSTS header.
4. Turn on multi-factor authentication. On the website admin, the email, and the hosting panel. Remove old staff accounts.
5. Mind the domains you are not using. Keep them renewed with mail turned off, or let them go on purpose, not by accident.

If you only do one, do the first. It is the most common gap, the cheapest to fix, and the one most likely to cost you or a customer real money.

Where this goes

Seven regions are up. Hamilton-Niagara, the Toronto area, and Ottawa are next, and the plan is to work across Ontario region by region until there is a picture of the whole province and a plain playbook to go with it. Not to sell fear. To put real local numbers next to a national story, and to give small businesses a reason, and a way, to spend the afternoon.

The reports, the combined numbers, and the five fixes are at hans.study/state-of-cyber-hygiene. If you run one of these sites and want to know where you landed, the data is there, and so is my inbox. If you would rather hand the whole list to someone and have it done, book a scoping call.