Companies need to scan their websites for malicious code in the same way that they scan email.