“We’re too small for anyone to bother hacking us” is one of the most common things small business owners believe about their own website — and it’s backwards. Small sites aren’t ignored by attackers. They’re targeted precisely because they’re usually the least defended.
Most attacks against small business websites aren’t a person deliberately choosing your business. They’re automated scripts scanning thousands of sites at once for the same handful of common weaknesses — an outdated plugin with a known vulnerability, a default admin username, a form with no spam protection, a file that shouldn’t be directly accessible. None of that requires you to be interesting. It just requires you to be unpatched.
What actually matters, in order of impact
Keep everything updated — WordPress core, plugins, themes. The overwhelming majority of small-site compromises trace back to a known, already-patched vulnerability in something that just never got updated.
Guard direct file access. Every PHP file in a WordPress theme should refuse to load if accessed directly rather than through WordPress itself — a simple, one-line check per file that closes off an entire category of exploit, and costs nothing to implement.
Validate and protect every form. A contact form without spam protection or server-side validation isn’t just an inbox-clutter problem — it’s an open door. Nonce verification (proving a submission actually came from your own form) and a honeypot field (an invisible trap field real users never fill in, but bots reliably do) stop the overwhelming majority of automated abuse without ever inconveniencing a real visitor.
Real backups, tested, not just enabled. A backup nobody’s ever restored from isn’t a real safety net — it’s an assumption.
“None of this requires a security budget. It requires discipline — the same habit of checking the basics, consistently, that separates a site that recovers from an incident in an hour from one that doesn’t recover at all.”
The takeaway
Security for a small business site isn’t about defending against a sophisticated, targeted attack — it’s about not being the easiest unlocked door on a street full of them. The basics, done consistently, close off almost everything that actually happens in practice.
