Website Security for Small Businesses — What Actually Gets Sites Hacked

HomeWeb ServicesGuidesWebsite security for small businessesWebsite security for small businesses: what actually gets sites hackedThe six weaknesses that account for most compromised small-business websites, how to spot a hacked site, and what to do about it — from a team that tests websites for a living.By Bath IT · Radstock · 2026We test websites for a living, and we also get the phone calls afterwards. The sites that get hacked are rarely targeted by anyone in particular — they're found by scanners that sweep the whole internet looking for a handful of well-known weaknesses. This guide is what those weaknesses are, in plain English, and what to do about each one.How small business sites actually get compromised1. Out-of-date softwareThe single biggest cause. A content system, theme or plugin with a published vulnerability is a door with the key under the mat — the exploit is public, and automated scanners try it against every site they find. WordPress sites suffer most, not because WordPress is bad but because plugins are written by thousands of people and abandoned by many of them. Fix: update promptly, remove what you don't use, and prefer fewer, well-maintained components.2. Weak or reused admin passwords, and no second factorLogin pages are attacked by bots trying leaked passwords from other breaches. If the password you use for the website admin is the one you used somewhere that got breached, it will be tried. Fix: a long, unique password from a password manager, two-factor authentication on the admin, and rate-limiting on the login page so ten thousand guesses an hour isn't possible.3. Exposed backups, config files and admin panelsA backup zip left in the web root, a .env or wp-config readable over the web, a database admin tool left installed, a staging copy nobody password-protected — scanners look for all of these by name. Fix: nothing sensitive below the web root, admin tools removed or locked down, and a check that the server refuses to serve dotfiles and archives.4. Forms that trust their inputContact forms, search boxes and login forms are where user input meets your code. If that input isn't validated and escaped, the classic attacks apply: SQL injection, cross-site scripting, uploads that turn out to be scripts. Fix: this is a build-quality question, and it's what our manual penetration testing looks for — automated scanners find configuration problems; they don't find logic flaws.5. Missing HTTPS configuration and security headersMost sites have a padlock now. Fewer have HSTS, a Content-Security-Policy, X-Frame-Options and the rest — the headers that stop a browser being tricked into loading your site inside someone else's page or running injected scripts. They cost nothing and take minutes. Our free scanner checks all of them.6. Email that can be spoofedNot the website itself, but the domain: without SPF, DKIM and DMARC records, anyone can send email that appears to come from your address. Customers get phished "from you". Fix: three DNS records, set up correctly — part of go-live on every site we build.What a compromised site looks likeOften, nothing — which is the point. Common signs: the site redirects visitors to spam or gambling pages (sometimes only from Google results, so the owner never sees it); pages you didn't write appear in search; Google flags the site as dangerous; your email starts bouncing because the domain is blacklisted; the hosting account is suddenly at its disk or bandwidth limit; or a customer tells you. If any of those happen, treat it as a breach until proven otherwise.What to do if it's happenedTake the site offline or put up a holding page — every hour it stays up it is doing damage to your reputation and your domain.Change every password: hosting, admin, database, FTP, email. Assume all of them are known.Do not simply restore last night's backup — the way in is still there. Find the entry point first.Restore from a backup taken before the compromise, update everything, remove what you don't need, then harden (headers, 2FA, rate limits).Check Google Search Console for security warnings and request a review once clean; check your domain against email blacklists.If customer data may have been exposed, you have obligations under UK GDPR — 72 hours to report to the ICO where there's a risk to individuals.The five-minute checklistEverything updated, unused plugins and themes deletedUnique admin password, 2FA on, login rate-limitedHTTPS with HSTS; security headers presentNo backups, config files or admin tools reachable over the webBackups taken automatically, stored off the server, and restored at least once to prove they workSPF, DKIM and DMARC on the domainOur free security audit runs 37 of these checks against any site in about a minute and gives you a letter grade and a fix list. It's the same scanner we start every security engagement with.Quick answersWordPress itself is maintained well. The risk is the plugins and themes around it — thousands of authors, many abandoned. A WordPress site with a handful of well-maintained plugins, kept updated, with 2FA on, is fine. One with forty plugins nobody updates is a matter of time.It helps with login attacks and some scanning, but it can't fix a vulnerable plugin or a form that trusts its input. Updating, removing what you don't use, and building properly matter more than any plugin.Run a scan, search Google for your domain and look for pages you didn't write, check Search Console for security warnings, and check the site from a phone on mobile data — some compromises only show to visitors arriving from Google.RelatedFree security audit →Security & penetration testing →Website design →More guides →Want a straight answer about your own site?Tell us what you've got and what you're trying to do. Free, no-obligation, within a working day.Ask usCall 07376 947 411Web design, development, hosting, security testing and IT support — built and looked after in Radstock, serving Bath, Somerset and the South West since 1996.Web ServicesWebsite DesignHosting & MaintenanceSecurity & PentestingOur WorkFree Security AuditFree SEO AuditIT SupportComputer RepairLinux InstallationWiFi & NetworksAccessoriesCompanyAboutContactWeb Design RadstockWeb Design Midsomer NortonGuides44 Bristol Road, Radstock, BANES, BA3 3EQ07376 947 411 · support@bathit.co.uk© 2026 Bath IT. All rights reserved.