Website security for small businesses: what actually protects you (and what's snake oil).

Most small business websites aren't hacked by a person who targeted them specifically. They're hacked by automated bots that scan millions of sites a day for one specific, unpatched vulnerability, and it doesn't matter whether you're a five-page local business site or a national brand, the bot doesn't know or care. That's actually good news: it means the defenses that matter most are unglamorous and mostly automatable, not an arms race against a determined attacker.

What a real hack actually costs

The direct cleanup cost, removing malware, restoring from backup, resetting credentials, typically runs a few hundred to a couple thousand dollars if you have a clean recent backup, and considerably more without one. The bigger cost is usually indirect: Google blacklisting a compromised site removes it from search results entirely until it's cleaned and reviewed, which can take days, and a "This site may be hacked" warning in search results or a browser interstitial does real damage to trust even after the fix. Businesses that get hit hardest are almost always the ones with no recent, tested backup to restore from.

The protections that actually matter

• ▸HTTPS/SSL on every page, non-negotiable, both for basic encryption and because browsers now flag non-HTTPS sites as "Not Secure" directly in the address bar
• ▸A disciplined patch cadence: CMS core, plugins, and themes updated on a schedule, not reactively after something breaks
• ▸Strong, unique admin credentials with two-factor authentication on every account with publishing or admin access
• ▸Login attempt limiting or rate limiting, so automated brute-force scripts get locked out instead of allowed unlimited guesses
• ▸A web application firewall (WAF), which filters malicious traffic before it ever reaches your site, most managed hosts and platforms like Cloudflare offer one
• ▸Automated, offsite backups with real retention, stored somewhere separate from the live site, so a compromised server can't take the backup down with it
• ▸Least-privilege user accounts: nobody has admin access who only needs to edit content

SSL doesn't mean "secure"

This is one of the most common misunderstandings small business owners have. The padlock icon in the browser bar means your connection to the site is encrypted, nothing more. It says nothing about whether your CMS has an unpatched vulnerability, whether your admin password is "admin123," or whether a plugin you installed three years ago has a known exploit. A site can have a perfectly valid SSL certificate and still get compromised in the same afternoon. Treat SSL as one item on the checklist, not the checklist itself.

WordPress-specific risk, since so many small business sites run on it

WordPress itself is reasonably secure when kept current, but its plugin ecosystem is the far more common attack surface. New vulnerabilities in popular plugins are disclosed continuously, and a site running 20-30 plugins, common for small business sites built incrementally over years, has that many more potential entry points. If you're on WordPress, audit your plugin list at least twice a year and remove anything you're not actually using, every inactive plugin is still a liability sitting on your server, disabled or not.

Signs your site may already be compromised

• ▸Unfamiliar admin users or unexpected changes to pages you didn't make
• ▸A sudden, unexplained drop in organic traffic, sometimes the first sign of a Google security blacklist
• ▸Strange redirects, especially on mobile, that send visitors to an unrelated site
• ▸Search results showing spammy or unrelated content for your domain ("Google, is this site hacked" is worth checking directly)
• ▸Your hosting provider emailing you about unusual outbound traffic or resource usage

If you get hacked: the first 24 hours

1. 1Take the site offline or into maintenance mode immediately, to stop further damage and protect visitors
2. 2Change every credential with access to the site: CMS admin, hosting, FTP/SFTP, database
3. 3Restore from your most recent clean backup rather than trying to manually remove malware from a live, compromised install
4. 4Update everything, CMS core, plugins, themes, before bringing the site back online, the vulnerability that let the attacker in is still open otherwise
5. 5Request a security review through Google Search Console if the site was flagged, so the warning gets lifted once you're actually clean

Where security fits into a maintenance budget

Security isn't a separate line item from general upkeep, it's one of the core reasons ongoing maintenance exists in the first place. Patch cadence, backup retention, and monitoring are exactly the deliverables a real maintenance plan should include by default, not an upsell bolted on after something already went wrong. A site that's actively maintained is, almost by definition, a site that's been kept current on the fixes that close off the vulnerabilities bots are scanning for.

None of this requires being a security expert. It requires discipline: patch on a schedule, back up automatically, use real credentials, and know what to do in the first hour if something goes wrong. If you'd rather this be handled reliably instead of hoping nobody notices the plugin you never updated, tell us what you're running and we'll tell you honestly where the real gaps are.