I once spent £432.18 on a “critical security patch” for a website that, at the time, consisted of exactly two pages and a low-resolution photo of a cat. It wasn’t even a professional site. It was a hobby blog I’d started to document my attempts at sourdough. But there it was-a blinking crimson banner in my hosting dashboard, screaming that my “environment” was “critically exposed” to “cross-site scripting vulnerabilities.”

I didn’t know what that meant. I just knew that “critical” sounded like my digital house was on fire. I hit the ‘Upgrade Now’ button, entered my card details, and watched the banner turn a soothing, expensive shade of green.

Looking back, I realized the irony. The company that told me I was in danger was the same company that sold me the cure. It’s a bit like a locksmith standing on your porch, pointing at your door, and telling you the wood is “susceptible to atmospheric structural failure” before conveniently mentioning he has a £200 spray that fixes it.

You don’t check the physics; you just want to be able to sleep at night. I fell for it because fear is a much more efficient motivator than logic. I stopped doing that-jumping at the sight of red-about four years ago, and my bank account (and my blood pressure) has been better for it.

The Anatomy of a Somersault

In Manchester, the rain has a way of making everything feel slightly more urgent. Sarah, a private tutor I know who works out of a small office in Oldham, was mid-marking a stack of 24 GCSE English papers on a Tuesday night. The clock was ticking toward 10:30 PM.

Her website is her lifeblood; it’s how parents find her, how she schedules sessions, and how she keeps the lights on. When she opened her email to find a message from her plugin provider titled “URGENT: Your site is at risk,” her stomach didn’t just drop-it did a full somersault.

The email was masterpiece of psychological warfare. It didn’t say her site was hacked. It said it was “vulnerable.” It used words like “exploit,” “backdoor,” and “reputational damage.” At the bottom, a bright blue button offered her a “Professional Security Suite” for £199 a year.

Sarah, exhausted and worried that her business would disappear overnight, almost clicked it. She felt that familiar, cold prickle of digital illiteracy-the feeling that because she didn’t understand the underlying code, she was at the mercy of whoever did.

This is the “security scare” business model in its purest form. It’s an industry built on the fact that most small business owners are rightfully focused on their actual work-tutoring, baking, lawyering, or selling widgets-and see their website as a mysterious black box.

When the people who built the box start making alarming noises from the inside, the natural reaction is to throw money at the box until the noise stops.

The Nightclub Metaphor

To understand why these warnings are often more about profit than protection, you have to look at how a Web Application Firewall (WAF) actually works. Think of your website as a nightclub. The “vulnerabilities” the scanners find are like someone noticing that the back door doesn’t have a double-bolt lock, or that a window on the second floor is slightly ajar.

A WAF is basically a bouncer standing at the front door. It looks at every person (or “packet of data”) trying to get in and checks their ID against a list of known troublemakers. If the person looks dodgy, the bouncer turns them away.

The trick is that for a small, local site, the “troublemakers” are rarely elite hackers trying to steal Sarah’s GCSE marking notes. They are automated bots-dumb programs that wander the internet knocking on every door they see.

Most modern hosting environments already have a “bouncer” at the main gate. Selling you an extra, “premium” bouncer for £199 is often redundant. It’s not that the security doesn’t exist; it’s that you’re being charged for a second layer of something you likely already have a version of, framed as an emergency rather than a standard maintenance item.

Crisis vs. Sales Targets

I’ve seen this play out in much more serious contexts, too. My friend Riley J.-M. works as a refugee resettlement advisor. Riley deals with real, visceral emergencies-people whose lives depend on the accuracy of information and the security of their data.

When Riley sees the way commercial tech companies use the language of “crisis” to upsell a small business on a malware scanner, it makes them laugh. In Riley’s world, a crisis involves a lack of clean water or a missing visa. In the digital marketing world, a “crisis” is often just a clever way to meet a quarterly sales target.

When you’re treated as an “account number” by a massive, faceless agency or a global hosting giant, these automated scares are part of the churn. They don’t know Sarah. They don’t know that £199 represents three days of tutoring. They just know that if they send 10,000 emails, 4% of people will be scared enough to click the button.

The Neighbor Protocol

This is where the local touch changes the math. When I talk to the team at Digital Refresh, the vibe is entirely different.

Being based in Manchester, serving people in Rochdale and Oldham, they can’t afford to play the “fear” game. If you scare your neighbor into buying something they don’t need, you’re going to run into them at the coffee shop eventually, and that’s a conversation nobody wants to have.

There is a profound difference between “duty of care” and “monetized fear.” Genuine care looks like a calm conversation about what your site actually needs.

It looks like saying, “Hey, we noticed your software is a version behind, so we’ve updated it for you,” rather than, “Your site is a ticking time bomb-pay us now.” Most of the time, the solution to a “vulnerability” isn’t a £200 upgrade; it’s the digital equivalent of turning it off and on again, or simply keeping your plugins updated and using a strong password.

“I remember talking to a plumber once who told me he could always tell which of his competitors were struggling for money because they’d start finding ‘cracks’ in every heat exchanger they looked at. ‘A crack is a death sentence for a boiler,’ he said. ‘So if you tell a homeowner there’s a crack, they’ll pay anything to fix it. But half the time, it’s just a scratch in the soot.'”

– Anonymous Plumber

The digital world is full of “scratches in the soot” being sold as “cracks in the heat exchanger.”

If you’re a small business owner and you get one of those “URGENT” emails, the first thing you should do is breathe. The second thing you should do is look at who sent it. If the person warning you about the problem is the only person who can sell you the solution, take a beat.

Ask for a second opinion. Look for a partner who measures their success by your growth and your rankings, not by how many “security incidents” they managed to scare you into preventing.

Security is important. Of course it is. But true security doesn’t feel like a ransom note. It feels like a quiet, well-maintained house where the locks work because they were installed correctly the first time, not because someone is standing outside shouting about ghosts.

Gardening Your Presence

We’ve moved into an era where “transparency” is often used as a marketing buzzword, but the reality is much simpler. It’s about being able to look a client in the eye and say, “You’re safe, and you don’t need to spend an extra penny to stay that way.”

That’s the kind of honesty that builds a business that lasts a decade or more. It’s the kind of honesty that understands that a small business in Manchester isn’t just an “account”-it’s a person trying to make something of themselves.

I’ve stopped jumping at the red bells. Now, when a dashboard tells me I’m at risk, I don’t reach for my wallet. I reach for my coffee, I check the “bouncer” at the door, and I go back to my work. Because usually, the only thing truly at risk is the salesperson’s commission.

You need someone who looks at your site and sees potential, not just a series of “critical vulnerabilities” waiting to be invoiced.

The next time Sarah sits down to mark those GCSE papers, I hope she knows she can ignore the blue button. She’s already doing the hard work. Her website should be the wind at her back, not a ghost under her bed.

And for the rest of us, it’s worth remembering that the most secure thing you can have is a partner you actually trust. That’s worth more than any £199 plugin ever will be.