Small business owners tend to assume they’re not a target — “why would anyone hack a local plumbing company’s website?” The honest answer is that most attacks aren’t targeted at all. They’re automated bots scanning the entire internet for known vulnerabilities in common platforms, and a small business running an outdated WordPress install is just as visible to those bots as a Fortune 500 company.
Outdated software is the most common way in
WordPress core, themes, and plugins all get security patches regularly, and sites running versions even a year or two behind are running known, publicly documented vulnerabilities that automated tools actively scan for. Keeping core, themes, and plugins updated is the single highest-leverage security action available, and it’s often neglected purely because nobody owns the responsibility once a site is “done.”
Weak or reused credentials are the second most common entry point
If your WordPress admin username is “admin” and the password is something you’ve used on three other accounts, you’re relying entirely on luck. Enforce strong, unique passwords for every admin-level account, and enable two-factor authentication on your WordPress login if your setup supports it.
HTTPS is table stakes at this point
If your site doesn’t show the padlock icon, browsers actively flag it as “not secure” to visitors, which hurts trust and conversions, and Google has used HTTPS as a ranking signal for years. Getting a free SSL certificate through Let’s Encrypt should be considered a baseline requirement, not an upgrade.
Backups that have never been tested aren’t really backups
I ask every new client the same question: when was your last backup, and have you actually tested restoring from it? Most say yes to the first question and can’t answer the second. A backup you’ve never tested restoring is a backup you’re hoping works, not one you know works. Automated daily backups stored off-server are the standard we set up for clients.
A web application firewall adds a meaningful layer
Services like Cloudflare filter malicious traffic before it reaches your site at all, and also help with performance through caching, so it’s close to a free win for most small business sites.
Forms are an underappreciated attack surface
Any form on your site that accepts user input needs proper sanitization and validation on the backend, not just front-end JavaScript checks a bot can bypass entirely. I’ve seen contact forms exploited to send spam through a site’s own mail server, which can get your domain blacklisted by email providers — a problem that has nothing to do with hacking your data but still damages your business.
The bottom line
A realistic baseline for most small business sites: automated updates or a monthly update-check routine, strong unique credentials with 2FA, HTTPS, a free-tier WAF like Cloudflare, and verified automated backups. That combination stops the overwhelming majority of the automated attacks that actually threaten small business sites — the sophisticated targeted attacks you see in the news are a different risk category, and honestly not the one most small businesses need to worry about most.