Could your small business website be hacked? How to tell, and how to make it safer
"Who would bother hacking us? We're just a small business."
It's a reasonable thought, but most attacks aren't personal. Automated tools scan millions of websites around the clock, looking for known weaknesses. If your site has one, it gets found, whether you're a bank or a bakery.
How small business websites actually get hacked
WordPress runs more small business websites than any other platform. In our survey of local business websites in Vancouver and Victoria, about 30% ran on it. The core software is well maintained. The risk lives in the add-ons. In its State of WordPress Security in 2026 report, the security firm Patchstack found:
- 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% from 2024
- 91% were in plugins and 9% in themes. WordPress core had only six, all low priority.
- 46% had no fix available when they became public
- About half of high-impact vulnerabilities were exploited within 24 hours of disclosure
Most small business sites rely on a stack of plugins, each from a different developer, each needing its own updates. In our local survey, 60% of WordPress sites also ran a page builder plugin such as Elementor, Divi or WPBakery, and 26% of those showing their version number were still on WordPress older than 7.0. That's a lot of doors, and attackers only need one left open. The other common ways in are weak or reused admin passwords and abandoned sites nobody is patching at all.
What happens when a site is hacked
Often, nothing you'd notice right away. Attackers usually want your site's reputation, not your attention:
- Hidden spam links or pages that sell pharmaceuticals, gambling or knock-off goods
- Visitors on phones redirected to scam sites
- Malware that infects visitors' devices
- Your site used to send spam, getting your domain's email blocklisted
- Your contact form or customer data quietly copied
The damage shows up later: a "This site may be hacked" warning in Google, a browser warning that scares customers away, a host suspending your account, or a cleanup bill.
Warning signs to watch for
- Google results for your site show strange titles or descriptions
- Customers mention being redirected, or seeing pop-ups you didn't add
- New admin users or pages you didn't create
- Your site is suddenly slow, or your host reports unusual traffic
- Emails from your domain start landing in spam
If you see any of these, change your passwords, contact your host or developer, and get the site scanned.
A security checklist for a WordPress site
- Update WordPress, plugins and themes promptly, ideally automatically
- Delete plugins and themes you don't use. Deactivated isn't enough.
- Use a strong, unique password and two-factor authentication on every admin account
- Remove old admin accounts for staff and contractors who have moved on
- Keep automatic off-site backups, and test that you can restore one
- Make sure the site uses HTTPS everywhere
- Put someone in charge of all of this, every week
That last item is the hard one. Security on a plugin-based site isn't a one-time fix. It's an ongoing chore, and it's the first one to slip when you're busy running a business.
The alternative: remove what attackers target
There's another approach: build the site so most of those doors don't exist.
A SiteFlo™ site is published as fast static pages. There's no database to break into, no plugins to patch, and no login page to guess passwords on. It's hosted on Cloudflare's global network, so it isn't sitting on a single shared server. Your team updates it by sending a message in Slack, so there are no website passwords to manage.
We move your existing WordPress content across, keep your page titles and descriptions, and redirect your old addresses, so you keep your search rankings without the security chores.
How exposed is your site? Run a free SiteFlo Fit check. In about a minute it looks for security issues such as outdated software and missing protections, and also covers speed, accessibility, search visibility, upkeep and privacy.
Sources: Patchstack, State of WordPress Security in 2026 (covers 2025); SiteFlo survey of local business websites in Vancouver and Victoria (details).