Your website is one of those things you set up once and then stop thinking about. It sits there, it shows your hours and your phone number, and nothing about it looks broken. That is exactly why a neglected website is one of the common ways a small business gets hacked, and why WordPress security starts with a question nobody asks: when did anyone last log into it?

I run one of these sites myself. parjenntech.com is a WordPress site, and this summer I found out the hard way what happens when WordPress security gets ignored. Nobody is immune to this, and WordPress security is not a set-it-and-forget-it job. I will get to that, because it is a better lesson than anything in a checklist.

Why WordPress security is really plugin security

Most small business websites run on WordPress. It powers more than 40% of all websites, according to W3Techs, and around here it is what most web designers build with.

WordPress itself is solid. A large team maintains it, and it updates itself when you let it. The risk is almost never WordPress. Nearly every WordPress security problem I have cleaned up came from the plugins and themes bolted onto it.

A plugin is a small add-on written by someone else. The contact form, the photo gallery, the thing that makes the menu slide out on a phone. A typical small business site runs twenty or thirty of them, written by twenty or thirty different people, some of whom stopped maintaining their plugin years ago. Each one is a WordPress security question you never think to ask.

Researchers who track WordPress flaws find that the large majority are in plugins and themes, not in WordPress itself. So when your site gets hacked, it is almost always through a plugin that had a known hole and never got the update that closed it. WordPress security, in practice, is plugin security.

How a neglected website actually gets hacked

This is the part people get wrong. Attackers do not pick your business. They do not know who you are.

What they run is an automated scanner. It crawls huge numbers of websites looking for one specific thing: a plugin at a version that has a known security hole. When the plugin maker finds a flaw, they publish an update to fix it, and by doing so they also publish the fact that the old version is broken. From that moment, every scanner on the internet knows what to look for.

If your site still runs the old version, the scanner finds it and breaks in. No person was involved. Nobody targeted you. Your site just happened to be on the list of sites running that version, and the list was easy to make.

That is why the update matters even when nothing looks wrong. The update is not about features. It is about closing a door that everyone has now been told is open. That is most of what WordPress security is: closing doors on time.

What happened to my own site this summer

I want to volunteer this, because it is the honest version of what WordPress security looks like when nobody is watching.

In August I did a full review of parjenntech.com. The site had looked fine for months. Underneath it, a plugin that had been abandoned by its developer had been throwing a fatal error since January. For some visitors, on some pages, the site simply went white. Not a warning, not an error message, a blank page. Nobody told me. Visitors who hit it just left.

There were also four old web applications on the same hosting account that nobody had touched in years, six databases that belonged to nothing, and nearly two hundred leftover database tables from plugins removed long ago. None of that was hacked, as far as I can tell. All of it was a door left open for no reason.

I clean this stuff up for clients. I still had it on my own site. The lesson is not that I am careless. It is that a working website gives you no signal, and without a signal, nobody looks. WordPress security fails quietly, which is the whole problem with it.

What a hacked website is used for

A hacked site almost never announces itself either. Attackers do not shut your site down, because a working site is more useful to them.

They add hidden pages selling counterfeit goods or pushing scams, riding on the good standing your site has with Google. They change the site so visitors get pushed to a page that tries to install something. If you have a contact form or a checkout, they copy what people type into it. Or they quietly redirect your visitors somewhere else, so a customer who clicks your link in a Google result ends up on a scam page.

Then the damage lands on you. Google flags the site and drops it in the rankings. Browsers show a red “this site may be dangerous” screen instead of your homepage. Customers see that and go to the competitor down the road. This is why WordPress security is a business problem, not a technical one.

Most owners find out from a customer, or from Google, not from their website.

Is your site at risk? It depends how it was built

If your site is on a hosted builder like Wix, Squarespace or Shopify, most of this is handled behind the scenes. The updates happen without you. Your WordPress security risk is lower, and you can mostly stop reading, though the login advice below still applies.

If you have a WordPress site that a web designer or an agency set up on hosting in your name, then keeping WordPress, the plugins and the theme updated is someone’s job. The question is whose.

Here is what I find when I ask that question of clients around Beaumont and League City. The designer built it, got paid, and moved on. The hosting company hosts it and nothing more. The owner assumed one of the other two was handling updates. Nobody was. The site has not been logged into since launch.

You can tell your site is at risk if you do not know who maintains it, if it has not been updated in a year or more, or if it runs plugins from a developer who has since disappeared. If you cannot answer the first question, the answer to the other two is probably yes. That is the whole WordPress security problem in one sentence: nobody owns it.

Seven WordPress security checks that actually get done

None of these are technical. Most of them are a login and a look, and together they are a WordPress security routine anyone can run.

Keep everything updated. WordPress, plugins and theme. Most sites can be set to update automatically, and for a small business site that is the right setting. The occasional update that breaks something is far cheaper than the hack it prevents.

Delete plugins you do not use. Every plugin is another thing that can go wrong, even when it is switched off. If it is not doing a job, remove it.

Watch for abandoned plugins. On the plugin screen, WordPress tells you when a plugin was last updated. Anything not touched in two years is a plugin nobody is fixing. Replace it. This is the one that got my site.

Lock down the admin login. A strong, unique password on the admin account, and two-step sign in if the site supports it, which most do with a small plugin. The admin login is the front door of your WordPress security, and attackers try it constantly.

Add a security plugin or a web firewall. A reputable one blocks the common automated attacks and tells you when something on the site changes. We can recommend one; the free tier of the well known ones is fine for most small sites.

Keep backups, and know where they are. If the worst happens, restoring last week’s copy is a two hour job. Rebuilding from nothing is a two month job. Ask whoever hosts your site whether backups exist and how you would get one.

Decide who owns it. Your web designer, your hosting company, or your IT provider. Write it down. Not “someone” but a name and an agreement. This is the check that makes the other six happen.

That last one is where we usually come in. Website upkeep is part of what we cover under patch management for clients, because WordPress security is patching, and an unpatched website is an unpatched computer that happens to face the whole internet.

If your site has already been hacked

Moving fast limits the damage. In this order.

Get help right away. Cleaning a hacked site properly is a job for your web host, your IT provider, or a WordPress security service. Hosts have seen this many times.

Take the site offline while it is cleaned. A simple “down for maintenance” page stops your visitors being harmed in the meantime, and it stops Google finding more to flag.

From a computer you know is clean, change the passwords for the hosting account and the admin login, and turn on two-step sign in.

Restore a clean backup from before the hack if one exists. If one does not, the site has to be cleaned by hand, which is slower and less certain.

Before it goes back live, update everything and remove anything you do not recognize. Otherwise the same hole gets used again next week.

And if the site handled customer details or payments, check whether any of that was exposed, and tell those people if it was. That part is not optional.

The honest note here is that a hacked site is a symptom of WordPress security that lapsed a long time ago. If the site was neglected, so was the backup, and probably so are a few other things. Our post on what immutable backup means explains why a backup an attacker cannot reach is the one that matters.

Frequently asked questions

How do I know if my website has been hacked? A warning from Google or your browser, a sudden drop in search traffic, pages or pop-ups you did not add, or your web host getting in touch about a problem. If you are not sure, your IT provider or web host can check.

Do I need to update my website if it works fine? Yes. A site can look completely normal while an out of date plugin leaves a door open. WordPress security updates close those doors, which is why they matter when nothing looks wrong.

Who is responsible for updating my WordPress site? Whoever you have agreed is. If you have not agreed with anyone, then nobody is. Pick your web designer, your host, or your IT provider, and put it in writing. Nearly every WordPress security gap I see comes back to this one decision.

I use Wix or Squarespace. Am I at risk? Much less. Hosted builders handle updates and most of the security for you. Still use a strong admin password and two-step sign in.

How much does a hacked website cost to fix? It varies a lot, and I do not want to be falsely precise. A clean restore from a good backup is a few hours. A hand cleanup with no backup can run to days, plus whatever business you lost while Google was flagging you.

What is a web firewall? A tool that sits in front of your site, blocks common automated attacks, watches for changes, and alerts you to problems. For WordPress security, a reputable security plugin is the usual way to get one.

If you do not know who last logged into your website, that is the whole answer, and it is worth thirty minutes to find out. We do a plain language review of the website along with everything else in the IT health checkup. It tells you what is out of date and who should own it, and nothing more than that.

Featured image: Pixabay