Small business websites are attacked all the time, and rarely because anyone is targeting you personally. Automated tools scan the internet looking for outdated software, weak passwords and unprotected forms, and they hit whatever they find. The good news is that most successful attacks exploit basic gaps, which means a handful of consistent habits prevents the majority of problems. This checklist covers what matters most for a small business WordPress site.
Why small sites get hacked
Attackers want access to resources: your server to send spam, your visitors to redirect to scams, or your reputation to host malicious files. Small sites are attractive because they are numerous and often under-maintained. The consequences for you are real: a compromised site can be blocked by browsers, drop out of search results, leak customer data and take days to clean up.
The practical checklist
1. Keep everything updated
Outdated WordPress core, plugins and themes are the most common way sites are compromised. Updates often patch known vulnerabilities, and attackers move quickly once those are published. Apply updates regularly, and test important pages afterwards so an update does not break your site. This is a core part of website maintenance.
2. Use strong, unique passwords and two-factor authentication
- Use a password manager and a unique password for every admin account.
- Turn on two-factor authentication for anyone who can log in to edit the site.
- Do not share one login between several people.
- Remove accounts for former staff and contractors straight away.
3. Limit who has admin access
Most people who edit content do not need to be administrators. Give each person the lowest level of access that lets them do their job. This limits the damage if an account is compromised.
4. Remove what you do not use
Inactive plugins and old themes still sit on the server and can still contain vulnerabilities. Delete anything you are not using, and avoid plugins that have not been updated by their authors for a long time.
5. Back up regularly, and store backups elsewhere
A backup is your recovery plan. It should run automatically, be stored away from the web server and be tested occasionally by restoring it. A backup that has never been restored is a hope, not a plan.
6. Use HTTPS everywhere
An SSL certificate encrypts traffic between your visitors and your site. It is expected by browsers and by customers, and it is essential for forms, logins and checkouts. Make sure the whole site loads securely with no mixed-content warnings.
7. Protect your login and forms
- Limit login attempts to slow brute-force guessing.
- Add spam protection to contact forms.
- Consider moving or protecting the default login page.
8. Choose hosting with security built in
Your server is the foundation. Quality managed hosting includes firewalls, malware scanning, current server software and isolation between sites, which cheap shared hosting often lacks. See our guide to why managed hosting matters and our website hosting service.
9. Monitor and scan
Security tools can alert you to suspicious changes, malware and uptime problems. Early warning turns a disaster into an inconvenience.
10. Have a plan for when something goes wrong
Know who to call, where the backups are and who has the logins. If you suspect a compromise, change passwords, take a backup of the current state for investigation and get help cleaning the site rather than guessing.
Security and ownership
Make sure your domain, hosting and website admin accounts are in your business’s name, and keep a record of who has access. A surprising number of security and recovery problems come down to nobody knowing who controls what.
Security extends beyond the website
- Protect email accounts with strong passwords and two-factor authentication, because attackers often use email to reset other logins.
- Be cautious with attachments and links in unexpected emails.
- Keep computers and phones used to manage the site updated.
Done-for-you options
You can follow this checklist yourself, but many businesses prefer to have it handled. Our managed website plans include ongoing care so updates, monitoring and backups do not fall to the bottom of the to-do list. For the cost of neglect, see our post on the hidden cost of a website nobody maintains.
Frequently asked questions
Is WordPress insecure?
WordPress itself is actively maintained and widely reviewed. Most compromises come from outdated plugins, weak passwords or poor hosting rather than the core software.
Do I need a security plugin?
A well-chosen security plugin can add useful protection, but it is not a substitute for updates, good hosting, strong passwords and backups.
How do I know if my site has been hacked?
Warning signs include unexpected redirects, new admin users, strange content, browser warnings, sudden drops in traffic or your host suspending the site. Monitoring helps catch these early.
Web Paste provides maintenance, hosting and support for Waikato and New Zealand businesses from our base in Raglan. Get in touch if you would like us to review your site’s security.
