Most small business sites are not targeted by a person. They are found by a script that scans the whole internet for one known flaw, finds it, and exploits it automatically. Nobody chose you. Your site simply had a version number that matched. That is why security feels random and why it is not.
We take over a lot of sites that have been hacked before, and the story is almost always the same. A plugin was out of date. A login had a weak password. A form had no protection. None of it was sophisticated. All of it was preventable.
This is a practical guide for people who run a business, not a security team. It covers what the current data says the real risks are, and what is worth your attention.
For a business site, security means three things: attackers cannot change your content, they cannot steal data your visitors give you, and they cannot use your domain to attack someone else. Everything else is detail. If those three hold, a breach becomes an inconvenience rather than a crisis.
That third one surprises people. A hacked marketing site is often not robbed at all. It gets quietly turned into a host for spam pages, phishing forms, or malware. You keep getting leads, the site looks fine, and then Google flags your domain and your traffic disappears overnight.
Security is also a search problem for that reason. A domain with a bad reputation is very hard to rehabilitate. Preventing that is cheaper than fixing it.
Because attacking software is now easier than attacking people. Verizon reported in its 2026 Data Breach Investigations Report that breaches starting with software vulnerabilities have overtaken stolen passwords as the top way attackers get in. That is a real shift. For years the answer was phishing. Now it is unpatched code.
This changes what you should worry about. Training your team to spot dodgy emails still matters, but it no longer covers the main risk. The main risk is a piece of software on your site that somebody else wrote, that has a published flaw, and that you have not updated.
It also explains why speed matters more than it used to. Patchstack notes in its State of WordPress Security in 2026 whitepaper that attackers weaponise new vulnerabilities within mere hours of disclosure. A monthly update routine is not fast enough when the window is that short.
The OWASP Top 10:2025, the eighth edition of the industry standard list, ranks broken access control first, security misconfiguration second, and software supply chain failures third. OWASP found that 3.73 percent of applications tested had at least one of the 40 weaknesses in that first category. Access control is the recurring failure.
Broken access control means someone can reach something they should not. An admin page with no check on it. A file URL that anyone can guess. A form endpoint that accepts requests from anywhere. It is unglamorous and it is number one.
Security misconfiguration climbed from fifth place in the 2021 list to second in 2025, with OWASP reporting 3.00 percent of tested applications affected across 16 weakness types. OWASP links this to how much of modern software behaviour now lives in configuration rather than code. More settings means more ways to get a setting wrong.
The third category is newer and worth understanding. Software supply chain failures expands the older vulnerable components category to cover dependencies, build systems, and distribution infrastructure. OWASP says it has the fewest occurrences in their data but the highest average exploit and impact scores from recorded CVEs. Rare, but severe when it lands.
Because a typical WordPress site runs code from dozens of separate authors, and any one of them can introduce a flaw. Patchstack recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42 percent increase on 2024. Of those, 91 percent were found in plugins and only 6 in WordPress core.
The severity numbers matter more than the total. Patchstack rated 1,966 of those, about 17 percent, as high severity, meaning they were likely to be hit by automated mass-scale attacks. Patchstack also reported that more high-severity vulnerabilities appeared in 2025 than in the previous two years combined, and attributed much of that rise to premium components sold on marketplaces like Envato.
None of this means WordPress is bad software. It means the plugin model spreads your trust across a lot of strangers. Every plugin you install is a decision to rely on someone you have never met to keep patching their code. We think about that tradeoff a lot when clients ask us to compare platforms, and we wrote up the fuller picture in our piece on choosing between Webflow and WordPress.
There is a harder problem underneath. Patchstack found that 46 percent of vulnerabilities did not receive a fix from the developer in time for public disclosure. Nearly half were announced to the world while the plugin was still broken. Updating promptly does not help when there is no update to install.
The practical rule is simple. Every plugin you can remove is a risk you no longer carry. Audit what is installed and delete what you are not using.
Less than people assume. Patchstack ran a large-scale penetration test against popular web hosting companies and found that only 26 percent of vulnerability attacks were blocked at the host level. That leaves roughly three quarters getting through. Hosting security is a useful layer, but it is not a substitute for patching your own software.
This is the finding we most often have to break to clients. They pay for managed hosting, assume the word managed covers security, and stop thinking about it. It does not cover application-level flaws, because the host cannot tell a legitimate request to your plugin from a malicious one without understanding that plugin.
Where hosting genuinely helps is the layer below your application. Server patching, network filtering, and denial of service absorption are real protections and they are hard to do yourself. Just do not extend that trust upward into your own code.
Mostly no, and that is a genuine win. Let''s Encrypt reported in December 2025 that it had become the largest certificate authority in the world by certificates issued, frequently issuing ten million certificates a day, and was on track to protect a billion active sites. Encryption stopped being a paid upgrade years ago.
The numbers on adoption are striking. Let''s Encrypt reported that the global share of encrypted web connections went from under 30 percent to around 80 percent in about five years, and has stayed near there, with the United States sitting close to 95 percent. Those figures come from Firefox telemetry published on their stats page.
So the only HTTPS question left is whether yours is set up properly. Check that the plain HTTP version of every page redirects to the secure one, that no image or script loads over plain HTTP, and that your certificate renews automatically. A half-configured certificate is worse than none, because it trains people to click through warnings.
Every third-party script you embed runs with the same access as your own code. An analytics tag, a chat widget, or a marketing pixel can read your forms and your cookies. If that vendor is compromised, so are you, and you will not get a warning. This is exactly the supply chain risk OWASP moved up its list.
We audit script tags on every site we inherit, and we usually find several nobody remembers adding. A tag for an agency that left two years ago. A heatmap tool from a trial that ended. Each one is a live connection to a company you no longer have a relationship with.
Removing them helps twice, because the same tags that widen your attack surface are usually the ones wrecking your load time. We covered the performance half of that argument in our breakdown of how third-party scripts slow down your website, and the security case points the same direction.
Start with access, because broken access control is the top risk on the OWASP list and the cheapest one to fix. Remove old admin accounts, turn on two-factor authentication for everyone who remains, and stop sharing one login. Then set up automatic updates for anything that supports them. That covers most of the real exposure.
After that, reduce surface area. Delete unused plugins, unused scripts, unused user accounts, and unused subdomains. Old staging sites left running on a subdomain are a classic way in, because nobody updates them and nobody notices when they break.
Then make sure you have a backup you have actually tested by restoring it. An untested backup is a hope, not a plan. We have watched teams discover during a live incident that their nightly backup had been silently failing for months.
Finally, put a content delivery network with a web application firewall in front of the site. Cloudflare and similar services filter a lot of automated junk before it ever reaches your server, and they help with speed at the same time, which we explain in our guide to what a CDN does.
Log in to your site and list every plugin, script, and user account it has. Delete anything you cannot justify. Turn on two-factor authentication. Confirm your backups run and can be restored. That is a couple of hours of work and it removes most of the risk a small business site actually faces.
Security work is unsatisfying because success looks like nothing happening. But the pattern in the data is consistent. The sites that get hit are rarely the ones attackers chose. They are the ones running something old that a scanner found first.
If you would rather someone else went through this with you, or you are weighing up a move to a platform with a smaller attack surface, we are happy to talk it through. Reach out at phoenix.studio and we will take a look at what you are running.
Tell us where you want to go. We'll tell you how we'd get you there.