WordPress Under Attack: A Small Business Owner’s Defense Checklist

Why your WordPress site is already being probed

If you run a WordPress site for your business, you should assume it’s being scanned right now. Not by a person sitting somewhere targeting you specifically, but by automated bots that crawl the entire internet looking for known weaknesses: outdated plugins, default usernames, exposed login pages, unpatched core files.

This is actually good news in a strange way. Most attacks against small business WordPress sites aren’t sophisticated. They’re opportunistic. That means the fixes don’t need to be sophisticated either. A handful of consistent habits will put you ahead of the vast majority of sites these bots find and compromise.

Keep everything updated, without exception

WordPress core, your theme, and every plugin you have installed are all potential entry points. When a vulnerability is discovered in any of them, it becomes public knowledge almost immediately, and automated tools start scanning for sites still running the vulnerable version within days.

What to actually do

• Turn on automatic updates for WordPress core minor releases at minimum.
• Check for plugin and theme updates at least once a week, and apply them promptly.
• Remove plugins and themes you’re not actively using. An inactive plugin can still be a vulnerability if it’s installed, even if it’s deactivated.
• Before updating anything on a live site, take a backup first (more on that below), so you can roll back if an update breaks something.

If you’re worried about updates breaking your site’s design or functionality, set up a staging copy of your site where you can test updates before pushing them live. Many hosting providers offer this as a built-in feature.

Fix your credentials before anything else

Weak or reused passwords are one of the most common ways small business sites get taken over. Automated tools run through massive lists of leaked username and password combinations against login pages all day long, a technique called credential stuffing. If you’ve ever reused a password across sites, and that other site had a breach, your WordPress login may already be in one of those lists.

Login hardening steps

• Never use “admin” as a username. If your site was set up with it, create a new administrator account and delete the old one.
• Use a unique, long password for your WordPress admin account, generated by a password manager rather than something you memorize.
• Turn on two-factor authentication for every account with administrator or editor access. This alone blocks most automated takeover attempts even if a password leaks.
• Limit login attempts so a bot can’t sit there guessing passwords indefinitely.
• Review your list of users periodically and remove anyone who no longer needs access, including former employees or contractors.

If multiple people manage your site, each person should have their own login. Shared logins make it impossible to know who did what, and they multiply the number of places a password can leak from.

Treat every plugin as a risk you’re accepting

Plugins are where most WordPress vulnerabilities are found, simply because there are so many of them and they’re written by thousands of different developers with varying levels of security discipline.

Questions to ask before installing a plugin

• Has it been updated recently? A plugin that hasn’t been touched in over a year is a warning sign.
• Does it have a reasonable number of active installs and decent reviews?
• Do you actually need it, or does it duplicate something your theme or another plugin already does?

Periodically go through your installed plugins and ask whether each one still earns its place. Every plugin you remove is one less thing that can be exploited. This is especially important for plugins connected to payments, forms, or user accounts, since those tend to be higher-value targets.

Back up like your business depends on it, because it does

No matter how careful you are, something can still go wrong: a bad update, a compromised plugin, a hosting outage, or a successful attack. A solid backup is the difference between an afternoon of annoyance and days of lost business.

A backup strategy that actually works

• Back up both your database and your files, not just one or the other.
• Store backups somewhere other than your own server, such as a separate cloud storage account. A backup stored on the same server as your site does you no good if that server is compromised.
• Automate backups so they run daily or weekly without you having to remember.
• Actually test restoring a backup at least once. A backup you’ve never tested is a backup you can’t be sure works.
• Keep more than one backup version. If a problem isn’t discovered right away, you want to be able to go back further than just the most recent backup.

Have a plan before you need one

The businesses that recover quickly from a WordPress compromise are the ones who decided what to do before it happened, not the ones scrambling to figure it out in the moment.

Build a simple recovery plan now

• Know who you’d contact for help: your host’s support team, a freelance WordPress developer, or a security specialist.
• Know where your most recent clean backup is and how to restore it.
• Know how to take your site offline quickly (a maintenance mode plugin or your host’s suspend feature) if you suspect it’s actively serving malware to visitors.
• Change all your passwords immediately if you suspect a breach, including hosting, WordPress admin, and any connected email or FTP accounts.
• Write these steps down somewhere accessible even if your site itself is down, since you won’t be able to check a note saved in your WordPress dashboard.

The mindset that keeps small sites safe

None of this requires deep technical expertise. Most successful attacks on small business WordPress sites exploit the basics: an old plugin, a weak password, a missing backup. Attackers running automated scans are looking for the easiest targets, not the most interesting ones.

Spend an hour setting up updates, credentials, and backups properly, and revisit them on a regular schedule. That consistency is what separates sites that get compromised from sites that don’t, far more than any single tool or setting.

For the complete, structured playbook on this topic, see WordPress Security for Business Owners in our library. New here? Start with our free guide.