Introduction
Yes, a small business can secure its WordPress site in one afternoon, and most of the work costs nothing. WordPress powers around 40 percent of all websites, which makes it the most popular target for automated attacks. But most hacked WordPress sites are not beaten by clever hackers. They are beaten by the same handful of weaknesses: outdated plugins, weak admin passwords, and backups that were never tested. This checklist closes those weaknesses in priority order, so you do the work that matters first.
The 80/20 of WordPress security
Security advice can feel endless, so start with the rule that matters. A small number of basics stops most attacks. Patchstack, a WordPress security research firm, found in its 2025 State of WordPress Security report that 96 percent of WordPress vulnerabilities in 2024 came from plugins, and another 4 percent came from themes. That tells you where to focus. Your plugins and themes are your biggest risk, not WordPress itself.
The same report found that a third of disclosed vulnerabilities were not patched in time for public disclosure, and half of all critical flaws were exploited within 24 hours of going public. Speed matters. When an update appears, it is often fixing a hole that attackers already know about. Work through the checklist below in order, and do not skip ahead to the interesting parts before the basics are done.
Step 1: update everything, then delete what you do not use
Outdated software is the number one cause of hacked WordPress sites. WordPress core, every theme, and every plugin release regular updates, and many of them are security patches. Open Dashboard, then Updates, and apply every pending update. Do this weekly at minimum. If your site takes enquiries or payments, check twice a week.
Turn on automatic updates for minor WordPress core releases. These are security patches, and WordPress installs them by default on most sites. You can also enable auto-updates for trusted plugins, but check the site afterwards. An update can occasionally break a layout or a form, so test your homepage, contact form, and checkout page after a round of updates.
Then delete what you do not use. A deactivated plugin is not a safe plugin. It still sits on your server, and it can still be exploited. The same applies to old themes. Delete every plugin you do not actively use, and keep only one spare theme (the default WordPress theme) as a fallback. Fewer plugins means fewer doors into your site, and fewer updates to chase each week.
Step 2: make sure your site runs on HTTPS
An SSL certificate encrypts the data between your site and your visitors. Without it, form submissions, login details, and payment information travel in plain text. Modern browsers flag sites without a certificate as “Not secure”, and visitors notice that warning.
Most UK hosts include a free certificate, and it takes about 15 minutes to set up. Our guide on getting a free SSL certificate for a small business website walks through the whole process: check your host first, use Let’s Encrypt if your host does not include one, and fix the mixed content warning that sometimes follows. Once the certificate is active, force your whole site onto HTTPS in Settings, then General, so no page ever loads over plain HTTP.
Step 3: add two-factor login for every admin
Your login page is one of the most targeted pages on the internet. Automated bots try common passwords against WordPress logins all day, every day. A strong password helps, but two-factor authentication (2FA) ends this attack almost entirely. Even if someone steals or guesses your password, they still cannot log in without the second factor, usually a code from an app on your phone.
The NCSC, the UK National Cyber Security Centre, puts it plainly in its Small Business Guide: if you are given the option to use two-step verification for any of your accounts, you should do it, because it adds a large amount of security for not much extra effort.
Install a plugin such as WP 2FA or Wordfence Login Security. It takes about five minutes. Turn it on for every administrator and editor account at minimum, and for any supplier or freelancer account too. While you are there, change your admin username if it is still “admin”. That is the first username every bot tries. Also make sure each person has their own login, so you never share one admin password across the team. Our guide on the best password managers for small teams shows how to give everyone a unique, strong password without anyone having to remember them.
Step 4: set up backups you can actually restore
A backup is only useful if it restores. Many small businesses discover too late that their backup was incomplete, corrupted, or stored on the same server as the site that was hacked. A backup on the same server is not a backup. If the server goes, the backup goes with it.
Set up daily, automated, off-site backups. Off-site means stored somewhere other than your web host, such as a cloud storage account. Most hosts offer daily backups, but do not rely on them as your only copy. Use a backup plugin or a separate backup service as well, and keep at least 30 days of history so you can roll back to a clean version from before a hack.
Then test the restore. This is the step everyone skips, and it is the step that matters most. Once a quarter, restore a backup to a test location or a staging copy of your site and confirm the site actually works. If the restore fails, you have found the problem on a quiet afternoon, not on the morning your live site is down. Write down the restore steps while you test them, so anyone on the team can follow them under pressure.
Step 5: give every user the lowest role they need
WordPress has five built-in roles: Administrator, Editor, Author, Contributor, and Subscriber. Each role can do less than the one above it. The principle is simple, and it has a name: least privilege. Give each person the lowest role that still lets them do their job.
An administrator can install plugins, change themes, and delete users. Most people on your team never need that power. A freelance writer needs an Author or Contributor account, not an Administrator account. A member of staff who only updates blog posts needs an Editor account at most. Every extra administrator is an extra account that, if compromised, gives an attacker full control of your site.
Once a month, open Users, then All Users, and review the list. Remove accounts for people who no longer work with you, and downgrade any administrator who does not need that level of access. Old accounts are a common way into a site, because nobody notices when they are used. Also check that no account shares a password with another service. One leaked password should never open two doors.
Step 6: close the doors you do not use
WordPress has a few features that most small business sites never use, but attackers probe constantly. Closing them costs nothing.
First, XML-RPC. This is an old feature that lets external apps talk to your site. Most sites do not need it, and it is a favourite target for brute-force login attacks. If you do not use the WordPress mobile app or a remote publishing tool, disable XML-RPC. Many security plugins can do this with one setting.
Second, limit login attempts. Without a limit, a bot can try thousands of passwords against your login page. A security plugin can lock an account or an IP address after a small number of failed attempts, and alert you when it happens. This one setting turns a brute-force attack from a certainty into a waste of the attacker’s time.
Third, stop user enumeration. By default, WordPress can reveal your usernames through author archive pages and the REST API. Knowing a valid username is half of a login attack. A security plugin can block this, or you can change your display name so it does not match your username.
Finally, disable file editing from the dashboard. WordPress lets administrators edit theme and plugin files from inside the admin area. If an attacker ever gets an admin login, that feature lets them plant malicious code in seconds. You can switch it off with one line in your wp-config.php file, or with a setting in a security plugin. You will still be able to edit files through your hosting panel when you need to.
Step 7: pick one security plugin, and configure it properly
Do you need a security plugin? For most small business sites, yes. A good one adds a firewall, malware scanning, login protection, and alerts in one place. Pick one of Wordfence, Solid Security, or Sucuri, and configure it properly. Do not run two in parallel. They fight each other, slow your site down, and create false alarms.
A free security plugin covers the essentials: a web application firewall that blocks known attack patterns before they reach your site, a malware scanner that checks your files for changes, and login protection. The paid version usually adds real-time threat updates, country blocking, and priority support. For a small brochure site, the free version is enough. For a site that takes payments or stores customer data, the paid version is worth the modest cost.
What matters more than the price is the configuration. Turn on the firewall, set the login limits, enable email alerts for admin logins and file changes, and schedule a weekly scan. A plugin that is installed but never configured is decoration, not security.
Step 8: what to check every month
Security is not a one-off job. Put a 30-minute monthly check in your calendar, and run through the same list each time.
First, check for pending updates and apply them. Second, review your users and remove anyone who should no longer have access. Third, confirm your last backup ran and that the files are stored off-site. Fourth, read any security alerts from your plugin, and act on them. Fifth, check your site loads over HTTPS with no warnings. Sixth, run a malware scan and review the results.
Once a quarter, add the restore test from Step 4. Once a year, review your plugins and delete any you no longer use, change all admin passwords, and check that your contact details on the site are still correct. This routine takes half an hour a month, and it catches the slow drift that turns a secure site into a vulnerable one.
What to do if your site has already been hacked
If you suspect a hack, do not panic, and do not try to fix it by deleting files at random. First, change all admin passwords from a clean device, and turn on two-factor authentication if it is not already on. Second, restore from a clean backup, one dated before the hack, and then update everything immediately. Third, scan the restored site with your security plugin to check for leftover malicious code. Fourth, tell your host. They can check the server logs and confirm how the attacker got in. Fifth, if customer data was involved, check the ICO guidance on reporting a breach. You have 72 hours to report certain breaches to the ICO, so do not delay this step.
After the cleanup, work through this checklist from the top. A hack usually means one of the steps above was missed. Fix the gap, not just the damage.
FAQs
Do I need a security plugin for my WordPress site?
For most small business sites, yes. A security plugin adds a firewall, malware scanning, login protection, and alerts in one place. Pick one plugin, such as Wordfence, Solid Security, or Sucuri, and configure it properly. Do not run two at once. The free version covers the essentials for a small brochure site.
How often should I update WordPress?
Check for updates weekly at minimum. If your site takes enquiries or payments, check twice a week. Enable automatic updates for minor core releases, which are security patches. Apply plugin and theme updates promptly, because half of all critical flaws are exploited within 24 hours of going public.
What if my WordPress site has already been hacked?
Change all admin passwords from a clean device, restore from a clean backup dated before the hack, update everything, and scan for leftover malicious code. Tell your host so they can check the server logs. If customer data was involved, check the ICO guidance on reporting a breach, because some breaches must be reported within 72 hours.
Is WordPress safe for a small business website?
Yes, when it is maintained. WordPress itself is well tested, and most attacks target outdated plugins, weak passwords, and missing backups rather than WordPress core. Follow this checklist, keep everything updated, and your site is as safe as any other platform a small business would use.
Do I need to pay for WordPress security?
No, not to start. The essentials on this checklist are free: updates, two-factor login, strong passwords, off-site backups from your host, and a free security plugin. Pay only when the free tools no longer fit, for example a paid security plugin for a site that takes payments, or a paid backup service with longer retention.
Conclusion
WordPress security for a small business is not a technical project. It is a short list of habits: update everything and delete what you do not use, run your site on HTTPS, add two-factor login for admins, keep off-site backups and test the restore, give users the lowest role they need, close the doors you do not use, and run one security plugin properly. Then check it all once a month.
Start today with the first three steps. Updates, HTTPS, and two-factor login take less than an hour between them, and they remove most of the risk. The rest of the checklist turns that one-off effort into a routine that keeps your site safe all year. And remember that your website is only one part of your security. The people who use it matter just as much. Our guide on how to spot a phishing email shows how to train your team to recognise the scams that target small businesses, so the site and the people behind it are protected together.
