How small business sites actually get hacked
Not by a person who chose you. By scripts that scan millions of sites for known weaknesses: a plugin version with a published vulnerability, an admin login with a guessable password and no second factor, a forgotten test site on the same hosting account. When they find one, they install code that sends spam, redirects your visitors to scams, hides pharmacy links in your pages for search engines to find, or holds the site to ransom. You usually find out from a customer, from Google flagging the site, or from your host suspending it.
Because the attacks are automated, the defence is habit rather than expertise. Every one of the six below is something a managed host or a care plan does routinely, which is most of what such a plan is for.
The six things
| # | Do this | How often | Why |
|---|---|---|---|
| 1 | Apply updates: platform, theme, plugins | Weekly on WordPress; hosted platforms do it for you | Most compromises exploit a vulnerability with a patch already available |
| 2 | Long, unique passwords and two-factor authentication on admin, hosting and registrar | Once, then for every new account | Credential stuffing and brute force are the second door |
| 3 | Daily off-site backups, and a test restore | Daily; test quarterly | Turns a disaster into an hour |
| 4 | Managed hosting with a web application firewall and malware scanning | Once, when choosing a host | Blocks most automated attacks before they reach the site |
| 5 | Remove unused plugins, themes, users and old test sites | Quarterly audit | Every unused thing is an unwatched door |
| 6 | Monitoring: uptime, file changes, blacklist status | Continuous | Hours to detection instead of months |
Source: Cybrial’s hosting and care practice, September 2026, and the pattern of compromises seen on sites taken over from other suppliers.
What HTTPS does and does not do
The padlock encrypts the connection between visitor and server so nothing is read or altered in transit. Every site needs it, and it is free. It does nothing for the site itself: an out-of-date WordPress with a vulnerable plugin is exactly as hackable with a padlock as without. Treat HTTPS as the floor and the six above as the building.
WordPress specifically
- Most WordPress compromises come through plugins, not the core software. Fewer plugins, from reputable sources, kept updated, is the rule.
- Do not use “admin” as a username. Limit login attempts. Add two-factor authentication with a plugin or through the host.
- Keep the database prefix and file permissions as the host recommends; managed WordPress hosts set these correctly.
- Turn on automatic updates for minor releases and plugins where the host offers it, with backups taken before each.
- Delete inactive themes and plugins entirely; deactivated is not removed.
If it happens
- Take the site offline or put it in maintenance mode so visitors are not harmed and Google stops indexing the damage.
- Change every password: admin users, hosting, database, FTP, registrar, and the email accounts associated with them. Turn on two-factor where it was off.
- Restore from a clean backup taken before the compromise, or have the host or a specialist clean the files.
- Update everything, remove anything unused, and find the entry point; a cleaned site with the same hole is reinfected within days.
- Request a review in Search Console if Google flagged the site, and check the Security Issues report.
- Tell affected customers if personal data may have been exposed; under UK GDPR, notifying the ICO within 72 hours may be required.
