"I'm Too Small to Get Hacked" -- The Myth That Gets Small Businesses in Trouble
Here's something most small business owners don't realize: hackers aren't sitting at a computer manually targeting you. They use automated bots that scan the entire internet, looking for websites with known vulnerabilities. It doesn't matter if you run a restaurant in Ohio or a law firm in Florida. If your WordPress site has an unpatched plugin or a weak password, the bots will find it.
Over 30,000 websites get hacked every single day. Most of them belong to small businesses, because small businesses are less likely to have security measures in place -- making them easier targets than large corporations that have dedicated IT teams.
The real risk: A hacked website doesn't just mean your homepage gets defaced. Attackers can use your site to send spam emails (getting your domain blacklisted), steal your customers' information, install malware that infects your visitors' computers, or hold your content hostage until you pay a ransom.
The good news: the steps to protect yourself aren't complicated or expensive. Most of what matters is free, and you can check many of these items off your list in an afternoon.
The 5 Most Common Ways WordPress Sites Get Hacked
Understanding how attacks happen helps you prioritize what to fix first.
1
Outdated plugins and themes
This is the #1 cause of WordPress hacks, accounting for more than half of all breaches. When a security flaw is discovered in a plugin, hackers immediately start targeting sites that haven't updated yet. Even plugins you installed and forgot about can create an open door into your site.
2
Weak or reused passwords
Bots run "brute force" attacks -- automatically trying thousands of common passwords against your login page. If your password is anything like "Password1" or the name of your business, it will eventually be cracked. Reusing a password from another account that was previously breached is just as dangerous.
3
Using "admin" as the username
WordPress used to default to "admin" as the administrator username. Many older sites still use it. Hackers know this, so they target "admin" first. If you're using "admin," you've already given attackers half of what they need to get in.
4
Poorly-coded or abandoned plugins
Not all WordPress plugins are created equally. Some are built by inexperienced developers, some haven't been updated in years, and some have been abandoned entirely. Any of these can contain vulnerabilities that attackers know how to exploit.
5
Cheap or poorly-configured hosting
On shared hosting plans, your site sits alongside hundreds of others. If one of those sites gets compromised and the host doesn't have proper isolation in place, the infection can spread to your site. The cheapest hosting options often skip security hardening to cut costs.
Your 2026 WordPress Security Checklist
Work through this list systematically. Start at the top -- items at the beginning have the biggest impact.
Before you start: Log into your WordPress dashboard and take note of everything that's there -- your current plugins, themes, and user accounts. You'll be reviewing each of these as you work through this checklist.
1. Update Everything -- Right Now
Log into your WordPress dashboard and click on "Updates" in the left menu. You'll see a list of anything that needs updating: WordPress core, plugins, and themes. Update all of them.
After that, turn on automatic background updates for WordPress core security releases. Go to Settings → General and look for the auto-update option. For plugins and themes, you can enable automatic updates individually from the Plugins and Themes screens -- hover over each one and look for the "Enable auto-updates" link.
One important note: Always make a backup before doing major updates (more on backups below). In rare cases, an update can conflict with another plugin and cause something to stop working. Having a backup means you can roll back in minutes if needed.
2. Fix Your Login Security
Your WordPress login page (usually found at yoursite.com/wp-admin) is the most attacked page on your entire site. Here's what to do:
- Change your username if it's "admin." Unfortunately WordPress doesn't let you rename a user directly. The workaround: create a new administrator account with a different username, log in with the new account, then delete the old "admin" account.
- Use a strong, unique password. At least 16 characters, combining letters (upper and lower), numbers, and symbols. Don't use it anywhere else. WordPress has a built-in password generator -- use it.
- Enable two-factor authentication (2FA). This adds a second step to your login: after entering your password, you'll also need to enter a code from your phone. Even if someone steals your password, they can't get in without your phone. The free "WP 2FA" plugin makes this easy to set up.
- Install a login limiter. A plugin like "Limit Login Attempts Reloaded" (free) will lock out anyone who enters the wrong password too many times, stopping brute force attacks cold.
- Make sure only admins you recognize exist. Go to Users → All Users and review the list. Remove any accounts you don't recognize or that no longer need access.
3. Install a Security Plugin
A good security plugin acts like a security guard for your website -- scanning for malware, blocking suspicious traffic, and alerting you when something unusual happens. You only need one.
Wordfence Security is the most popular option and its free version is genuinely excellent. It includes a web application firewall, malware scanner, and login security features. After installing it, run a full scan of your site. If Wordfence finds anything, it will walk you through the steps to clean it up.
Sucuri Security is another strong option with a good free tier. It focuses on monitoring and hardening your site's configuration. Many professionals use both Wordfence and Sucuri together.
Once you've installed a security plugin, take 10 minutes to go through its settings. Enable email notifications so you'll be alerted if something suspicious happens.
4. Set Up Automated Backups
A backup won't prevent an attack, but it's the single thing that turns a disaster into an inconvenience. If your site is hacked or something goes wrong with an update, a recent backup means you can restore everything to the way it was in minutes instead of starting over from scratch.
- Back up daily if your site changes frequently (e-commerce, blog, appointments). Weekly is fine for brochure-style sites that rarely change.
- Store backups off your server. If your server is compromised or crashes, backups stored on it are worthless. Send them to Google Drive, Dropbox, or Amazon S3.
- Test a restore at least once. Many business owners have "backups" they've never tested, only to find they're broken when needed.
- UpdraftPlus (free) is the most widely-used WordPress backup plugin. It handles scheduling and can automatically send copies to Google Drive or Dropbox.
5. Make Sure You Have SSL (the Padlock Icon)
When you visit a website, look at the address bar. If the URL starts with "https://" and there's a padlock icon, that site has SSL encryption. If it shows "http://" without the padlock -- or worse, a "Not Secure" warning -- that's a problem.
SSL encrypts the connection between your visitor's browser and your server, so nobody can intercept data being sent back and forth. This is especially important if you have any forms on your site -- contact forms, quote requests, or anything where customers enter personal information.
Good news: SSL certificates are free through most modern hosting providers via a service called Let's Encrypt. If your site doesn't have one, call your hosting company and ask them to enable it. It takes about five minutes on their end.
6. Audit Your Plugins and Themes
Go to your Plugins page and look at each plugin critically. For each one, ask:
- Am I actually using this? If not, delete it. Inactive plugins are still a security risk -- they can still be exploited even if they're deactivated.
- When was it last updated? If the "Last Updated" date is more than 12 months ago, that's a yellow flag. If it's been 2+ years, that plugin may be abandoned -- find an alternative.
- How many active installs does it have? Popular plugins with hundreds of thousands of installs tend to be better maintained. Obscure plugins with a few hundred installs may not get regular security attention.
- Is it from a reputable source? Only install plugins from the official WordPress plugin directory (wordpress.org/plugins) or from well-known premium marketplaces like Envato. Avoid installing plugins sent to you via email or downloaded from random websites.
Do the same review for your themes. You should only have one active theme (plus possibly one default WordPress theme as a fallback). Delete everything else.
7. Protect Your WordPress Admin Area
A few extra steps make your admin dashboard significantly harder to attack:
- Disable the file editor. WordPress has a built-in code editor (Appearance → Theme File Editor, Plugins → Plugin File Editor) that lets you edit files directly from the dashboard. If a hacker gets in, this is the first place they go to inject malicious code. Add this line to your wp-config.php file to disable it:
define('DISALLOW_FILE_EDIT', true); -- or use your security plugin to do it for you.
- Limit who has administrator access. If someone only needs to write blog posts, give them "Editor" or "Author" access -- not "Administrator." Go to Users → All Users and review each person's role.
- Keep your WordPress version hidden. By default, WordPress broadcasts its version number in your site's source code. Security plugins like Wordfence can hide this, so attackers can't look up known vulnerabilities for your specific version.
8. Pick the Right Hosting
Your hosting provider is the foundation everything else sits on. If they have poor security practices, your efforts above can still be undermined.
Look for a host that offers: automatic malware scanning, daily backups, isolated hosting accounts (so other sites on the server can't affect yours), and a Web Application Firewall (WAF) at the server level. Managed WordPress hosting from providers like WP Engine, Kinsta, or SiteGround generally includes all of these and costs $25–$50/month -- worth it for a business site.
Signs Your Site May Already Be Compromised
Sometimes you don't know you've been hacked until you see one of these warning signs:
- Your site loads slowly or goes down frequently without explanation
- Google Search Console sends you an alert about "unusual activity"
- Visitors tell you they're being redirected to a different website
- Your site appears on Google's "Safe Browsing" blacklist (you'll see a warning when trying to visit it)
- You get notifications about new admin accounts you didn't create
- Your hosting provider suspends your account for sending spam
- You find unfamiliar files in your WordPress directory when looking through your file manager
If you see any of the above: Don't panic, but act quickly. Change all your passwords immediately. Contact your hosting provider -- they often have tools to scan for malware. Then either work with a professional or use a service like Sucuri's malware removal to clean the site. The longer you wait, the more damage can occur.
What to Do If Your Site Gets Hacked
Even with good security practices in place, the unexpected can happen. Here's the order of operations:
1
Don't delete anything yet
It's tempting to start removing files, but this can destroy evidence and make cleanup harder. Take a full backup of the infected site first, even in its compromised state.
2
Put your site in maintenance mode
This prevents visitors from seeing the hacked version and stops the spread of malware to your customers. A simple plugin like "Maintenance" can do this in one click.
3
Change all passwords
WordPress admin passwords, your hosting control panel password, FTP passwords, and your database password. Do this before cleaning anything -- otherwise the attacker can just get back in.
4
Run a malware scan
Use Wordfence or your hosting provider's malware scanner to identify infected files. Remove what it finds. If it finds dozens of infected files, a full restore from a clean backup may be faster than manual cleanup.
5
Find and close the entry point
If you don't figure out how they got in, they'll just come back. Common culprits: an outdated plugin, a compromised password, or a vulnerability in your theme. Check your security plugin logs for clues.
6
Request removal from blacklists
If Google flagged your site, submit a review request through Google Search Console once your site is clean. This usually takes 24–72 hours to process.
Questions to Ask Your Web Developer or Host
If someone else manages your website, don't assume they're handling security. Ask these questions directly:
- "Are all plugins, themes, and WordPress core being kept up to date? Who's responsible for that?"
- "Do we have automated daily backups? Where are they stored?"
- "Is there a security plugin installed and actively monitored?"
- "Does the site have an SSL certificate and does it redirect HTTP to HTTPS?"
- "What happens if the site gets hacked -- what's the response plan?"
A good web professional will answer these confidently. If you get vague answers or pushback, that's a sign your site may not be getting the attention it needs.
How Much Does WordPress Security Cost?
The basics are free. Wordfence (free version), UpdraftPlus (free version), and WP 2FA (free) together cover the most critical areas. A good SSL certificate is free through your hosting provider. This gets you most of the way there at no cost.
For more robust protection, Wordfence Premium ($119/year) adds real-time threat intelligence. Managed WordPress hosting with built-in security runs $25–$50/month. If you've already been hacked, professional cleanup typically costs $200–$500 depending on the severity.
Compare that to the cost of being hacked: lost revenue during downtime, customer trust you may never get back, potential legal liability if customer data was exposed, and the time and money to rebuild. Spending $150/year on security is one of the best ROI decisions a small business can make.
Not sure where your site stands?
I offer security reviews for small business WordPress sites -- I'll check everything on this list, tell you exactly what needs attention, and either fix it for you or give you clear instructions to do it yourself. No jargon, no upselling.
Schedule a Security Review →
