Website security for small businesses: how sites get hacked and how to stop it
Dimitri · 10 min read
Most small business sites are not hacked by someone targeting them. They are hit by automated attacks on outdated plugins. Here is how it happens and how to stop it.
Most owners picture a hacker as someone who chose their business on purpose. In reality, website security for small business owners is mostly about defending against robots. Automated tools scan millions of sites a day looking for one outdated plugin, and when they find it, they move in. Nobody in particular wanted your bakery or your law office. Your site just had an open door.
This guide explains how small business sites actually get hacked, using the latest data from the people who clean them up. Then we give you a 15-step hardening plan, the backup rule that makes recovery possible, and a clear timeline of what to do if your site has already been compromised.
How small business websites get hacked
There are a handful of common routes in. They have not changed much in years, which is good news: you can defend against all of them.
1. Vulnerable plugins and themes
This is the big one. Patchstack's State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than the year before. Of those, 91% were in plugins and 9% in themes. WordPress core had just 6.
Wordfence, using its own database, reported a similar picture for 2024. Its annual threat report found 8,223 vulnerabilities published that year, with plugins accounting for 96% of them.
Two more Patchstack findings explain why this hurts small sites so much. First, 46% of vulnerabilities had no patch available when they were disclosed. Second, the weighted median time to first exploit was about 5 hours. If you update once a month, you are leaving the door open for weeks.
2. Stolen or guessed passwords
Wordfence reported blocking over 55 billion password attacks in 2024. These are bots trying common passwords and leaked username and password pairs against login pages, all day, every day. An admin account with a reused password and no multi-factor authentication is an easy target.
3. Old accounts and too much access
Former employees, a past web designer, a marketing contractor from three years ago: every account that still has admin access is a risk. Sucuri's 2023 threat report found malicious admin users in 55.2% of the infected WordPress databases it cleaned. Attackers love to create an admin account for themselves so they can come back.
4. Weak hosting and neighbours
On cheap shared hosting, a hacked site next door can sometimes affect yours. Good hosting isolates accounts and keeps server software current. But hosting is not a complete defence. Patchstack found that combined hosting defences blocked only 26% of attacks in its 2025 tests. If you would rather have hosting looked after for you, see our hosting service.
Figure 1: What cleanup teams found on infected sites. Source: Sucuri, 2023 Hacked Website and Malware Threat Report.
What attackers actually do with your site
Most hacks on small business sites are about using your site's reputation, not stealing from you directly. Google's documentation on hacked content describes four common types: code injection (malicious JavaScript added to pages), page injection (new spammy or phishing pages), content injection (hidden links or text in existing pages) and redirects that send some visitors elsewhere based on their device or where they came from.
The most common outcome we see is SEO spam. Sucuri found it on 42.22% of infected sites in 2023. Your homepage looks normal to you, but Google's index fills with pages selling pharmaceuticals or counterfeit goods under your domain. Your rankings drop, Google may label the site, and you only notice when the phone stops ringing.
Sucuri also found at least one backdoor on 49.21% of compromised sites. A backdoor is hidden code that lets the attacker return later. That is why deleting the obvious bad file rarely fixes a hack for good.
The Canadian picture
This is not just a problem for big companies. Statistics Canada reported that about 1 in 6 Canadian businesses (16%) were impacted by cyber security incidents in 2023. Spending on recovery doubled from about $600 million in 2021 to $1.2 billion in 2023. Scams and fraud were the most common method, affecting 50% of impacted businesses, and ransomware affected 13%.
Website security for small business: a 15-step hardening plan
Turn on multi-factor authentication for every admin
Password attacks
15 min
Critical
2
Apply security updates within a day of release
Plugin exploits
Ongoing
Critical
3
Daily off-site backups, restore-tested quarterly
Everything (recovery)
1 hr setup
Critical
4
Remove unused plugins and themes, not just deactivate
Plugin exploits
30 min
High
5
Replace abandoned plugins (no update in a year)
Unpatched holes
1 to 2 hrs
High
6
Use unique, long passwords from a password manager
Credential stuffing
30 min
High
7
Audit users: remove old accounts, lower roles
Insider and leftover access
15 min
High
8
Use reputable hosting with account isolation
Neighbour infections
Varies
High
9
Add a web application firewall
Known attack patterns
30 min
Medium
10
Limit login attempts and change the default admin username
Brute force
15 min
Medium
11
Disable file editing in the WordPress dashboard
Attacker code edits
5 min
Medium
12
Keep PHP and server software current
Server-level exploits
Host task
Medium
13
Force HTTPS everywhere
Data interception
15 min
Medium
14
Set up Google Search Console and uptime monitoring
Late detection
30 min
Medium
15
Only buy premium plugins from vendors with a security record
Supply-chain risk
Ongoing
Medium
The first three matter most
If you only do three things this week, do steps 1 to 3. Multi-factor authentication means a stolen or guessed password alone is no longer enough to get in. Fast updates close the main way in. And tested off-site backups mean that even if everything else fails, you can recover in hours instead of weeks.
Fewer plugins, fewer problems
Every plugin is a separate piece of software from a separate vendor. Fewer plugins means fewer chances for one of them to have a hole. Patchstack also flagged premium components: 76% of vulnerabilities found in premium plugins and themes were exploitable. Paying for a plugin does not make it safer by default. This is one reason some businesses choose a lean custom build; our comparison of WordPress and custom-coded websites covers the trade-offs.
Backups: the 3-2-1 rule
A backup is your undo button. But many owners discover their only backup is on the same server that just got hacked, or that it stopped running six months ago.
The Canadian Centre for Cyber Security recommends the 3-2-1 rule: three copies of your information (one original and two backups), saved on two different types of media, with one copy kept off site. It also stresses testing that restores work and keeping some backups offline so ransomware cannot reach them.
For a small business website, that looks like this:
Copy 1: your live website.
Copy 2: your host's daily backup, kept for at least two weeks.
Copy 3: an automated daily backup sent to separate cloud storage that your host cannot touch, with its own login and multi-factor authentication.
Copy
Where it lives
How often
Protects you from
1. Live site
Your hosting account
Always current
Nothing on its own
2. Host backup
Host's backup system
Daily, kept 14+ days
Bad updates, accidental deletions
3. Off-site backup
Separate cloud storage with its own login and MFA
Daily
Hacks, host failures, account lockouts
Then, once a quarter, restore a backup to a staging site and click around. If you have never done a test restore, you do not know whether you have a backup.
What to do if your site has been hacked
If you see warning signs, such as strange pages in Google, mobile visitors redirected to other sites, unknown admin users, or a browser warning, do not panic and do not start deleting files at random. Work through it in order.
Figure 2: Hacked site response timeline. Schedule: Clear Pixel recommendation.
Hour 0 to 1: contain
Change passwords for hosting, WordPress admins, FTP or SFTP, and the database. Turn on multi-factor authentication.
Tell your host. Many will help, and some will isolate the account.
If the site is actively attacking visitors (redirects, malware downloads), put up a maintenance page.
Hours 1 to 4: preserve and assess
Take a full backup of the infected site. It is evidence, and it helps you work out how they got in.
Check Google Search Console for security issues and see which pages Google has indexed.
Find your most recent clean backup and note its date.
Day 1: clean and close the hole
Either restore a clean backup from before the infection, or clean the site file by file and in the database.
Remove unknown admin users and look for backdoors.
Update everything and remove the plugin that let them in. Restoring a backup without fixing the hole just resets the clock.
Days 2 to 7: recover your reputation
Once clean, request a review in Google Search Console if Google flagged the site.
Remove spam URLs from the index and watch for new ones.
Watch traffic, rankings and forms for a few weeks.
If your site collected personal information and you think it was accessed, talk to a privacy lawyer about your obligations under PIPEDA or Alberta's PIPA.
DIY or professional cleanup?
If you have a clean backup from before the hack and you know which plugin caused it, a careful owner can handle the restore. If there are backdoors, database injections or no clean backup, get help. We handle cleanups at our troubleshooting rate of $135 CAD per hour, and the first thing we do is close the hole so it does not happen again.
Make security a habit, not an event
The sites that stay clean are not the ones with the most expensive security plugin. They are the ones where someone does the boring work every week: updates, backups, a glance at users and alerts. Our post on the maintenance habits that keep a site fast and secure lays out the full schedule, and our $80 CAD per month maintenance package covers it for you. Security work is part of the true cost of a website, which we break down in how much a small business website should cost in 2026.
Frequently asked questions
01Why would hackers target my small business website?
Usually they are not targeting you specifically. Automated tools scan the web for sites running vulnerable plugins, then use them for SEO spam, redirects or phishing. Patchstack reported a weighted median time to first exploit of about 5 hours after a vulnerability is disclosed.
02How do I know if my WordPress site has been hacked?
Common signs include strange pages in Google results, visitors redirected to other sites on mobile, unknown admin users, a browser or Google warning, sudden traffic drops, or emails from your host. Some hacks, like SEO spam, are hidden from logged-in admins, so check Google Search Console as well.
03Is a security plugin enough to protect my site?
No. A security plugin or firewall is one layer. Updates, strong logins with multi-factor authentication, fewer plugins, and tested off-site backups matter more. Patchstack found hosting defences blocked only 26% of attacks in its 2025 tests.
04How much does malware removal cost?
It depends on how deep the infection goes and whether you have a clean backup. We handle cleanups at our troubleshooting rate of $135 CAD per hour. A recent, clean, off-site backup can turn a long cleanup into a short restore.
05What is the 3-2-1 backup rule?
Keep three copies of your data (the original and two backups), on two different types of media, with one copy off site. It is the approach recommended by the Canadian Centre for Cyber Security.
Get a security check before you need a cleanup
Want to know how exposed your site is right now? Book a free 15-minute call and we will go over plugin and core versions, admin users, backups, HTTPS and common weak spots with you, then give you a short, prioritized fix list. If you think you have already been hacked, our hacked website cleanup will get you back online fast. To keep it from happening again, website maintenance covers security updates and daily backups.
