Quick answer
Your small-business website is not being targeted by hackers in the movie sense. It’s being scanned, constantly, by automated bots probing every WordPress site on the internet for the same handful of known weaknesses: outdated plugins, guessable logins, and abandoned installations. That’s good news, because bot-proofing is achievable in one afternoon: updates current, strong unique admin credentials with 2FA, a reputable security plugin, verified off-site backups, and decent hosting. That set defeats the overwhelming majority of real-world attacks. The exotic 10% is what managed hosting and ongoing maintenance are for.
A site built on a clean, current stack needs far less of this; a bespoke WordPress website from us ships hardened from day one.
Know your actual enemy
Automated attacks don’t care who you are: a two-page decorator’s site gets the same probes as a national retailer, because compromised sites are commodities: used to send spam, host phishing pages, redirect visitors to scams, or mine SEO value until caught. The practical consequences for you are real, though: blacklisted email, Google’s “this site may be hacked” label torching your rankings and click-through, cleanup bills of £300 to £1,000+, and — if customer data was involved — UK GDPR breach duties. Prevention is an afternoon; each of those is a bad month.
The one-afternoon hardening list
| Step | Time | What it defeats |
|---|---|---|
| 1. Update everything; delete inactive plugins/themes | 30 to 60 min | The #1 entry route: known holes in old code |
| 2. Fix logins: no “admin” user, unique strong passwords, 2FA on every admin | 30 min | Brute force and credential-stuffing bots |
| 3. Install one reputable security plugin (Wordfence, Solid Security or similar) | 20 min | Login limiting, file-change monitoring, firewall rules |
| 4. Verify backups: daily, off-site, and do one test restore | 30 min | Turns any disaster into an inconvenience |
| 5. Check hosting basics: PHP version current, SSL valid, account passwords rotated | 20 min | Server-level rot, and cheap hosting is a security decision; see what hosting should cost |
| 6. Remove old admin users and agency accounts no longer needed | 10 min | The forgotten doors: ex-developers, old VAs, “temp” accounts from 2022 |
Step 6 is the most-skipped and most personal: every credential that ever had access still does until you remove it. The audit takes ten minutes; do it today, then quarterly as part of the maintenance rhythm, and bake the whole list into go-live via the launch checklist so new sites start hardened.
What not to buy
- Multiple security plugins. They conflict, duplicate work and slow the site. One good one, configured.
- “Military-grade” security add-ons and sold-by-fear extras: hiding the WordPress version, obscuring login URLs and similar theatre add marginal value over the fundamentals above.
- A £30/month “security package” from a host that hasn’t patched PHP since 2021: check what’s actually included; backups + firewall + malware scanning is often already in decent hosting or your security plugin’s free tier.
Already hacked? The recovery order
Signs: strange redirects, spam pages in your Google results, defacement, hosting suspension emails, or customers reporting warnings. The order that works: (1) change every password (WordPress, hosting, database, email); (2) restore from a clean backup if you have one predating the compromise, which is why the backup step exists; (3) otherwise use your security plugin’s scan or a professional cleanup (£300 to £1,000; hosts and specialists offer it); (4) update everything and remove unknown admin users, or you’ll be re-hacked through the same door within days; (5) request review in Google Search Console if you were flagged, and check your email domain against blacklists. Then do the afternoon list properly, because the second hack is the one that should embarrass. If any customer personal data was exposed, assess whether the ICO’s 72-hour breach reporting duty applies — pretending not to know is the expensive option.
The security questions to ask any web agency
If someone else built or manages your site, your security posture is mostly their habits, so audit them with five questions. “Who has access, right now?” You want a current list of every admin account and hosting login, and removal of anyone who’s left the project (the answer “just us” without a list is a fail). “What’s the update routine?” A cadence (“weekly, with a backup taken first”) beats a shrug; “we update when something breaks” means your site is the canary. “Where do backups go and when did you last restore one?” Off-site, daily, and a tested restore; backups on the same server as the site die with it. “What happens if the site is hacked at 5pm Friday?” You’re listening for a process and a response time, not reassurance that it won’t happen. “Do I own the hosting account and domain?” Security includes not being locked out of your own property when the relationship ends. Good agencies answer all five without flinching and usually volunteer them in the care-plan paperwork; the ones who bristle are telling you something more useful than any scan report. Put the answers in writing with the contract: accountability documented in advance is the cheapest security control there is.
What one compromise actually costs, itemised
Cleanup invoices are the visible part of the bill and rarely the biggest part. Here is the shape of a realistic worked example: a five-van heating firm generating around 40 enquiries a month from search, roughly a fifth of which convert at an average job value of £900.
| Line | Realistic cost | Why |
|---|---|---|
| Professional malware cleanup | £300 to £1,000 | Specialist or host service, one-off |
| Site offline / warning-flagged, 6 days | ~£1,400 | 8 enquiries lost at a 20% close rate on £900 jobs |
| Ranking recovery lag, 3 to 6 weeks | £1,000 to £2,500 | Traffic returns gradually after a malware flag clears |
| Email deliverability repair | £0 to £400 | Domain blacklisted after spam relay; quotes stop arriving |
| Your own time, 15 to 25 hours | £450 to £750 | Chasing hosts, customers and Google instead of quoting |
| Rebuild if backups were missing | £1,500 to £6,000 | The scenario that turns an incident into a project |
Even the good version — clean backup, quick restore — lands somewhere around £3,000 once lost work is counted, against an afternoon of prevention and perhaps £20 to £60 a month for hosting and monitoring that would have caught it. That ratio is the whole argument, and it is why security belongs in the same budget line as website management and hosting rather than being treated as an occasional purchase after something goes wrong.
Audit your plugins in twenty minutes
Plugins are the attack surface. Open the plugins screen and work down the list with four questions per row:
- When was it last updated? Anything untouched for over a year is a candidate for removal; over two years and the developer has almost certainly moved on. Abandoned plugins are the ones that stay vulnerable forever.
- Is it doing something the theme or WordPress already does? Most sites carry two or three plugins installed for one small job in 2021 and never removed. Every one of them is code executing on every page load.
- Does it accept input from the public? Contact forms, file uploads, booking widgets, comment tools and membership plugins are inherently higher risk than a layout helper, because strangers can send them data. Keep these ruthlessly current and prefer the well-maintained market leaders.
- Is the licence still active? An expired premium licence usually means updates stop silently: the plugin sits there looking fine and receiving no patches. Worse is the nulled or pirated premium plugin from a download site: a meaningful proportion carry injected backdoors, and it is the single most reliable way a small business infects its own site. If you genuinely need functionality nobody sells, having it built properly as a custom plugin costs less than one cleanup and one lost month.
A tidy site runs perhaps eight to fifteen plugins. Thirty-five is not a feature set, it is a maintenance liability, and it is usually why the site is slow as well as exposed.
If you take payments or hold customer records
An online shop raises the stakes because the site now handles money and personal data together. Three practical rules cover most of it. First, use a hosted payment method (Stripe, WooPayments, PayPal or similar) so card details are entered on the gateway’s infrastructure and never touch your database; that keeps your PCI DSS obligations to the lightest self-assessment tier instead of a serious compliance exercise. Second, remember that even without card numbers your orders table holds names, addresses, phone numbers and purchase history, which is exactly what makes a small shop worth attacking. Third, apply least privilege: staff who pack orders need a shop-manager role, not administrator, and every extra checkout, upsell or shipping plugin is another dependency on someone else’s code quality. Businesses weighing that ongoing burden against a hosted alternative will find the trade-off laid out in our Shopify versus WooCommerce comparison. Hosted platforms genuinely remove a class of problem, at the cost of flexibility and monthly fees.
The UK duties most owners have never been told about
Beyond the cookie banner, UK GDPR requires “appropriate technical and organisational measures” for the personal data you hold. That is what the hardening list above is, in legal terms, and being able to describe your measures matters if you are ever asked. Three further items catch small businesses out. Your hosting company and any plugin that sends data elsewhere are processors, so you should have their data processing terms on file. Cyber insurance policies increasingly make multi-factor authentication and current backups a condition of cover, meaning a claim can be refused over exactly the steps you skipped. And if you want public-sector or larger commercial contracts, Cyber Essentials certification (typically a few hundred pounds a year for a small firm) is often a tender requirement, and its checklist is close to the one on this page. The wider obligations that apply to any system holding customer records are covered in our guide to what GDPR compliance actually requires.
Five things that undo the afternoon
- A staging or “old” copy of the site left live. The forgotten dev. subdomain never gets updated and is a wide-open door into the same server.
- Backup archives sitting in the public web folder. A downloadable zip of your entire site, including database credentials, is worse than no backup at all.
- Using the administrator account for daily editing. Write posts as an editor; log in as admin only when you need to. It limits what a hijacked browser session can do.
- Shared logins. One “office” account used by four people means no accountability and no clean way to revoke access when someone leaves.
- Ignoring the update emails for eight months. Security is a habit, not an event; the afternoon buys you a clean baseline, and a quarter of an hour a month keeps it.
Get the UK Website Project Brief Template (free)
A two-page template for briefing any UK web designer: sitemap, integrations, audience and deliverables. Cuts revision rounds in half.
No spam. UK GDPR compliant. We only use your email to send this resource, unless you tick the box to hear from us.
Sources & Further Reading
- Small Business Cyber Security Guide, NCSC
- Hardening WordPress, WordPress.org
- Reporting Data Breaches, Information Commissioner's Office
Frequently asked questions
How do small business websites actually get hacked? +
Almost entirely by automated bots exploiting known weaknesses: outdated plugins and themes, guessable or reused admin passwords, and abandoned installations. Targeted human attacks on small sites are rare, which is why the basic hardening list defeats the overwhelming majority of real attempts.
What security does a WordPress site need? +
Five fundamentals: everything updated with inactive plugins deleted, strong unique logins with 2FA and no "admin" username, one reputable security plugin, daily off-site backups you have test-restored, and current hosting (PHP version, SSL). That set is achievable in one afternoon.
How much does it cost to fix a hacked website? +
Professional cleanup runs £300-£1,000+ depending on damage, plus the indirect costs: blacklisted email, a "site may be hacked" label suppressing Google traffic, and GDPR duties if customer data was exposed. A clean backup predating the compromise turns most of that into an hour's restore.
Do I need to pay for WordPress security plugins? +
Usually not at first: the free tiers of reputable plugins (login limiting, malware scanning, firewall basics) cover the small-site threat model when combined with updates, 2FA and backups. Paid tiers add real-time firewall rules and support, worth it for e-commerce and high-dependence sites.
What should I do immediately if my site is hacked? +
In order: change all passwords (WordPress, hosting, database, email), restore a clean pre-compromise backup if one exists, otherwise run a professional cleanup; update everything and delete unknown admin users; then request Google review if flagged. If customer data was exposed, check whether the ICO 72-hour breach duty applies.
