Almost every small business WordPress site that gets compromised is compromised by something automated. No one targeted the bakery. A script crawled the web looking for a known hole, found one, and walked in. That is good news, because defending against automated attacks is mostly a matter of closing the handful of doors those scripts try. Here is what actually matters, in order of how much it protects you.
What Happens When a Small Business Site Gets Hacked
A hacked WordPress site rarely looks dramatic. The homepage does not get defaced with a message. Instead, an attacker quietly adds pages that sell pharmaceuticals or counterfeit shoes, hidden from your menu but visible to Google. Or the site starts sending spam email, or redirecting visitors on phones only, so the owner never sees it from a desktop.
The damage shows up later and in the wrong place. Google flags the domain and search traffic drops. The hosting company suspends the account for sending spam. Customers who do reach the site get a red browser warning telling them it is dangerous. In practice, the cleanup is almost never the expensive part — the expensive part is the weeks of lost search visibility while Google re-trusts the domain, which is why prevention is worth far more than any recovery plan.
Updates Close More Holes Than Anything Else
Software updates are the single most effective WordPress security measure, and they are the one most often skipped. The automated attacks that hit small sites almost all exploit known vulnerabilities in old plugin versions — holes that were published, patched, and then scanned for at scale. Running the patched version makes your site invisible to that entire category of attack.
Turn on automatic updates for WordPress core and for plugins you trust. Then check the site manually once a month for the plugins you do not auto-update, usually the ones tied to your theme or your payment flow. Also keep PHP current — hosts leave old PHP versions running for compatibility, and an unsupported PHP version stops receiving security patches entirely. Our WordPress maintenance checklist walks through the monthly pass in more detail.
Logins Are the Most Common Way In
The login page is where automated attacks spend most of their effort, guessing username and password combinations thousands of times. Two settings remove nearly all of that risk. First, no account should use “admin” as its username, because that halves the guessing work. Second, every account needs a long, unique password stored in a password manager rather than reused from somewhere else.
Then add two-factor authentication for any account that can install plugins or edit code. Two-factor turns a stolen password into a dead end. Also check your user list and delete accounts nobody uses — the freelancer from two years ago, the former employee, the “test” account someone made during the build. Finally, give each person the lowest role that lets them do their job: a staff member who writes blog posts needs Author, not Administrator.
Fewer Plugins Is a Security Decision
Plugin count is a security number, not just a speed number. Every plugin is code from a stranger running inside your site with full access to your database. Thirty plugins means thirty separate projects whose maintenance you are trusting, and abandoned plugins are a common entry point because nobody is left to patch them.
Open your plugin list and judge each one on three questions. Does it do something a visitor would notice? When was it last updated? Is the feature it provides already in your theme or in WordPress itself? Deactivate and then delete anything that fails. Deleting matters — a deactivated plugin still sits on the server and can still be exploited in some cases. For example, a site running three separate contact form plugins because of three past redesigns only needs one.
Backups Are the Only Real Safety Net
A working backup is the difference between a bad afternoon and a lost business asset. Everything else on this list reduces the chance of a problem; backups are what make a problem survivable. The standard is a daily automatic backup of both files and database, stored somewhere other than the server the site runs on.
Off-server storage is the part people get wrong. A backup sitting in the same hosting account disappears with the account when the host suspends it or the server fails. Send backups to cloud storage or use a service that keeps them on its own infrastructure. Then, and this is the step almost nobody does, restore one backup to a staging site once to confirm the backups actually work. An untested backup is a guess, and the moment you discover it was a bad guess is the worst possible moment.
Hosting Does More for Security Than Any Plugin
Your hosting environment decides how much of this you have to handle yourself. Cheap shared hosting puts your site on a server with hundreds of others, sometimes with weak isolation between accounts, so a neighbor’s compromised site can become your problem. Managed WordPress hosting costs more per month and handles patching, server-level firewalls, and malware scanning as part of the service.
For a small business whose website generates real inquiries, managed hosting is usually the cheaper choice once you count the hours. Look specifically for automatic core updates, daily off-server backups with one-click restore, a free SSL certificate, staging sites, and malware scanning. Then confirm the site actually loads over HTTPS everywhere, including images and scripts, since mixed content triggers browser warnings on an otherwise healthy site.
What a Security Plugin Can and Cannot Do
A security plugin is a useful layer, not a replacement for the items above. The genuinely helpful features are login rate limiting, two-factor authentication, file change monitoring, and alerts when something unexpected happens. Those catch problems early and block the crudest automated attacks.
What a security plugin cannot do is protect a site running a plugin with a known vulnerability, or recover a site with no backups, or stop someone who already has your password. It also cannot undo the cost of installing three of them at once, which is a real pattern — overlapping security plugins conflict, slow the site, and bury real alerts in noise. Pick one, configure it properly, and leave the rest alone.
If You Think You Are Already Compromised
Suspect a compromise when search results for your domain show pages you did not write, when the host emails about spam, or when visitors report redirects you cannot reproduce. Act in order rather than deleting things at random, because random deletion destroys the evidence needed to find how the attacker got in.
First, take a full backup of the compromised site, even though it is infected, so nothing is lost. Then change every password, including hosting and database. Next, ask your host whether they offer malware cleanup, since many include it. Finally, after the site is clean, find and close the original hole — otherwise the same script returns within days. If you want this handled rather than researched, WordPress development and maintenance is what we do, and you can tell us what is going on. We write back within one business day.
