Website Security for Small Businesses

How small sites actually get compromised

Almost nobody chooses your business. Attacks against small websites are automated: a bot requests a predictable file, reads a plugin's version number out of it, checks that version against a list of disclosed vulnerabilities, and fires the matching exploit. No human ever looks at your site or decides you are worth the trouble. The reassurance that you are too small to be a target is exactly backwards - being small does not make you invisible, it makes you cheap.

In rough order of how often we see them:

1. One password, used in several places. The same password on the host, the registrar, the email account and a forum breached years ago. Bots replay the leaked pair against every login form on the internet.
2. A plugin nobody updated. Disclosed, exploitable, still sitting there.
3. A plugin nobody can update. The developer stopped publishing, so no update is coming, ever. This is the most common real finding in an honest audit, and updating cannot fix it.
4. An old set of credentials. The previous designer still has an admin account, or a file-transfer password sits saved on a laptop that picked up an information stealer.
5. A badly isolated shared server, where one compromised account reaches into others.
6. The contact form, used as a relay. Covered below, because the symptom is so misleading.
7. A text or phone call pretending to be your host, driving you to a login page that harvests the password and the one-time code in real time.

Few of those are stopped by anything sold as website security.

It used to be the password. Now it is the plugin as well.

Verizon's Data Breach Investigations Report is the closest thing this field has to an independent annual dataset, and its 2026 edition reported a turning point: exploitation of vulnerabilities became the leading initial access route at 31 percent of breaches, ahead of stolen credentials for the first time in the report's history. It also found 48 percent of breaches involved a third party - and for a small business, that third party is your web designer, your host, or a plugin vendor.

The vendor Patchstack reported 11,334 new vulnerabilities across the WordPress ecosystem during 2025, up 42 percent year over year. The distribution matters more than the total: 91 percent in plugins, 9 percent in themes, and six in WordPress core itself, all low priority. WordPress is not the problem. The twenty-three plugins somebody installed years ago are.

Two more findings from that research cut against what gets sold. First, 46 percent of vulnerabilities had no patch available at public disclosure, so keep everything updated is necessary but not sufficient. Second, the median time from disclosure to mass exploitation for heavily targeted vulnerabilities was about five hours. A monthly maintenance login cannot beat a five-hour window; the workable answer is automatic updates plus a backup you can restore quickly. And in the same research, paid components carried substantially more known-exploited vulnerabilities than free ones - so we only use premium plugins is not a security argument.

Multi-factor authentication on the registrar matters more than anything on the site

If you do one thing after reading this page, do this one. Turn on multi-factor authentication where your domain is registered, and at your host, before you turn it on anywhere else.

The reasoning is a chain that runs one direction. Whoever controls the domain controls where your email is delivered, and whoever controls your email can trigger a password reset on essentially every other account the business owns, because a password reset is an email. The domain therefore sits above the website, the host, the social accounts and the bank alerts. The standard mistake is to protect the website while leaving a decade-old password on the registrar account.

Losing the website is a bad afternoon: you restore a backup, or at worst rebuild. Losing the domain is a different category of problem. The site goes dark, the email goes dark with it, and getting the name back can mean a registrar dispute, a formal proceeding, or negotiating with whoever caught the name after it dropped. There is no backup that restores a domain name.

The same logic explains why the registration must be in the business's own name, on an account the business controls. A domain registered in a designer's account is a security failure with no technical fix - it cannot be patched, scanned or firewalled. It is fixed with a conversation and a transfer, and the best time for that conversation is while everyone is on good terms.

The contact form that turns your site into a spam relay

This one deserves its own section because the symptom does not look like a hacked website at all. It looks like silence.

A contact form that drops visitor-supplied text into the headers of the outgoing email - the From, Cc or Bcc fields - can be manipulated by inserting newline characters, adding recipients the form was never meant to reach. The technique is called email header injection, and your website then sends spam on somebody else's behalf, at volume, from your server.

What happens next is the expensive part. The server's sending address lands on blocklists and your own legitimate email stops being delivered. Quotes and invoices vanish into spam folders or are rejected, and nobody tells you. The first sign is usually a customer mentioning that they emailed last week and never heard back. If the host notices first, it suspends the account, taking the website and the email down together.

The fixes are free and permanent. A form should send from your own authenticated address, put the visitor's address in the reply-to field rather than the from field, and carry a spam control such as a honeypot or a challenge widget. An upload form should never be able to write executable code into a directory the web server will run - a one-line rule most paid security plans never set. And submit your own form once a month to confirm it arrives.

What a five-page brochure site genuinely needs

Ordered by protection delivered against cost. All of it is free or nearly free.

1. Unique passwords in a password manager for the registrar, the host control panel, the site admin, the business email and the DNS. Highest return on the list.
2. Multi-factor authentication on the registrar and the host first, the site second.
3. Automatic updates enabled for core, plugins and themes. WordPress has shipped automatic core security updates since version 3.7 and offers per-plugin toggles in the admin.
4. Unused plugins and themes deleted, not deactivated, and fewer plugins overall. A deactivated plugin's files are still on disk and reachable by URL, and on a brochure site plugin count is the attack surface.
5. A backup you can restore, somewhere the host cannot reach, holding the files and a database dump.
6. HTTPS with automated renewal. Free, and mandatory in practice now that certificate lifetimes are short and expiry reminders have ended.
7. Accounts removed when people leave, and no account literally named admin.
8. Correct SPF, DKIM and DMARC records on the sending domain, so a forged invoice claiming to be from you is rejected and your real mail gets through.

The first four account for most of the real risk reduction available at this size, and all four are free.

What gets sold to a site like this, and is theater at this scale

For a brochure site with no login, no cart and no customer data:

• A paid web application firewall subscription. A firewall of this kind filters requests in front of an application; if there is barely an application, it filters nothing that matters. The marketing also overstates them: in Patchstack's testing, host-level firewalls blocked only 12 percent of known-exploited vulnerabilities. Worth having on a store or a membership site. Not on five pages of text and photos.
• Malware scanning on a static HTML site. No server-side code, no database, no plugins - a product sold against a risk that does not exist.
• An SEO security audit. Not a real category. Buy a security scan, several of which are free, or a search audit with a defined list of deliverables.
• Payment card compliance scanning where no card number ever touches your server, and trust seals, which verify nothing while loading a third-party script on every page.
• Cyber liability insurance sold by a web company. Buy it from a licensed agent, where it is regulated and usually cheaper bundled into the business policy.
• Hiding the version number and renaming the admin folder. Free and harmless, but it does not stop a scanner that fingerprints your plugins directly. Fine to do; not fine to pay for.
• A security plan whose deliverable is a monthly PDF. Ask what it does at two in the morning when a critical bug is disclosed. If somebody checks on the first of the month, you bought a report.

What a compromise actually costs, in the order it actually happens

The industry oversells the last item here and undersells the first four. In frequency order, being compromised looks like:

1. A full-screen browser warning. Google Safe Browsing flags the site, traffic goes to zero immediately, and clearing it requires cleaning up and requesting a review.
2. The host suspends the account for sending spam, taking the website and the email down at the same moment.
3. Spam links and pages injected into the site for someone else's rankings. The most common payload, deliberately hard to see, and it takes months to undo.
4. Email deliverability damage - the most expensive for a service business, because you never learn which quotes failed to arrive.
5. Actual theft of data. Rarest, because a brochure site holds nothing but contact form submissions.

And being up to date is no guarantee. In Sucuri's 2023 hacked website report, 39.1 percent of infected content management systems were out of date at infection - meaning most were current and were compromised some other way, usually a stolen password.

Backups are the security product that actually works

Backups are the cheapest security measure in existence and the only one that ends an incident rather than reducing its probability. Summaries of the 2026 Data Breach Investigations Report put the share of small and medium businesses that refused a ransom demand because they had reliable backups at 69 percent.

But the host's backup and a backup you control are different products. The host's copy lives on the same server, is retained for a week to a month, and does not survive the host suspending your account, a billing dispute, or a designer locking you out. A copy you downloaded survives all of those. The old rule holds: three copies, two kinds of media, one somewhere else.

Two failure modes catch nearly everyone. The first is backing up files but not the database, which restores a WordPress site with no pages, no posts and no settings. The second is retention shorter than the problem: notice injected spam six weeks in, with seven days of host backups, and every restore point is already infected. For a site that rarely changes, how far back backups reach matters more than how often they are taken.

An untested backup is a hypothesis. Restore one once a year; that hour is when most businesses find out something was wrong.