Website security basics: how small sites actually get hacked

Where small-site break-ins usually start

It is natural to picture someone choosing your business as a target. The reality is more mundane. WordPress's own hardening guide notes that many attacks are carried out automatically by bots, and that compromises are rarely down to the hosting infrastructure. They are most often down to the application itself, which the guide describes as the environment the site owner is responsible for.

In practice, that mostly means add-ons. Patchstack, a company that tracks WordPress vulnerabilities, recorded 11,334 new ones across the WordPress ecosystem in 2025, 42% more than in 2024. Of those, 91% were in plugins and 9% in themes. WordPress core itself had six, all of them low priority.

That is not a reason to avoid WordPress or plugins. It is a reason to treat each one as code written by someone else, which you are trusting to be maintained. The same applies to any site builder where you add apps, widgets or integrations. And because so much of this activity is automated, being a small business offers no protection on its own.

Lock the front door: passwords and two-step verification

The June 2024 incident is worth a second look, because the victims weren't beginners. They were plugin developers, and according to WordPress.org the attacker got in by trying username and password combinations that had already been exposed in data breaches on other websites. A reused password was enough to turn trusted plugins into a delivery route for malicious code. The UK's National Cyber Security Centre (NCSC) explains why this works so well: criminals know that many people use the same password for different accounts, so they try a leaked one everywhere.

Two habits shut that door. The first is a unique password for every account that can change your website: the site's admin login, the hosting control panel, the domain registrar and, above all, the email address that receives password resets. Nobody can remember all of those, which is what a password manager is for. WordPress.org's advice to its own developers after the incident was a unique password of at least 20 characters, with a password manager to generate and store it.

The second is two-step verification, sometimes called two-factor authentication or MFA. After your password, the service asks for a second proof, usually a code sent to your phone or generated by an app. As the NCSC puts it, even if a criminal knows your password, they won't be able to get into your account. Switch it on first for your email and hosting accounts, because whoever controls those can usually reset everything else.

Fewer administrators, fewer plugins, fewer ways in

Every administrator login is a master key. WordPress's guide warns that someone who gets into an administrator account can install malicious scripts that could compromise the entire server. So for each account, the question isn't whether you trust the person, but whether they need full control today.

Most people who write posts or update opening hours don't. Give them an editor or author role, and remove the logins left behind by the designer who finished last year, the agency you stopped using and the colleague who moved on. WordPress.org gave its plugin developers the same advice in 2024: keep access to the smallest number of people possible, audit it routinely, and remove it when it is no longer needed.

Software deserves the same treatment. WordPress's guide is blunt: if you are not using a plugin, delete it. Install plugins and themes only from the official WordPress.org directory or well-known companies, never from sites offering paid themes for free. Patchstack found that 46% of the vulnerabilities it recorded in 2025 had no fix available when they were disclosed, so a plugin you have removed is one you will never have to wait on.

A security routine you can keep up

Updates come first, because the gap between a flaw being published and being used can be very short. WordPress has been able to update itself automatically since version 3.7, and the hardening guide is clear that older versions don't receive security updates. Where your dashboard or host allows it, switch on automatic updates for plugins and themes too, and keep a recent backup so you can roll back if an update breaks something.

The rest fits into a short routine. Give it a named owner, so it doesn't quietly become nobody's job, and adjust the timing to how often your site changes.

If something looks wrong: your first hour

The NCSC's guide for small businesses lists warning signs such as people telling you about strange emails coming from your domain, redirected internet searches, being locked out of accounts and unusual account activity. On a website, that might look like visitors being sent to another site, spam pages turning up in search results, or an administrator account nobody recognises. A calm, methodical first hour helps more than a rushed fix.

Resist the urge to restore a backup straight away. If the outdated plugin or leaked password that let someone in is still there, a restored site can be compromised again by the same route. The NCSC's recovery steps pair restoring from backups with patching software and changing passwords, and that combination is the point. In the UK, a business suffering a live cyber attack can call 0300 123 2040 at any hour, and the NCSC strongly encourages reporting incidents, noting that many go unreported.