14 September 2026

Is Your Business Website Quietly Putting You at Risk?

Illustration by kreatikar on Pixabay

A business website tends to get built once and then left completely alone. It works, it sits there doing its job, so there's no obvious reason to log back in. That's exactly the kind of neglect that makes a website one of the easier ways for a small business to get hacked, not through anything the business did wrong, but through what's quietly running underneath it.

Most small business sites run on WordPress, which now powers around 41% of all websites according to W3Techs' usage statistics. WordPress itself is a solid, well-maintained platform. The actual risk almost always sits one layer up, in the plugins and themes bolted onto it, which can go years without an update once a site is left to run itself.

The weak point isn't WordPress, it's what's added to it

Patchstack, a firm that tracks security flaws across the WordPress ecosystem, logged 11,334 new vulnerabilities in 2025, up 42% on the year before. Of those, 91% were found in plugins and 9% in themes. WordPress core itself accounted for just six, all rated low priority.

That gap matters because of how quickly it gets used. When a plugin developer finds a security flaw, they release an update to close it. Until that update is installed, the hole stays open, and Patchstack's own research found that for the most heavily targeted vulnerabilities, the typical time to first exploit after disclosure is around five hours. Roughly half of high-impact vulnerabilities are exploited within a day. There is very little grace period between a flaw becoming public and someone trying to use it.

How the attack usually starts

Nobody sits down and picks your business by name. Automated tools scan huge numbers of websites at once, looking for one specific, known weakness, an outdated plugin with a security hole that's already public knowledge. When the tool finds a site still running the vulnerable version, it gets in on its own, with no person on the other end making a judgement call about your business specifically.

That's also, deliberately, what a proper vulnerability assessment does, just on your side of the fence: the same kind of automated scanning, run on your behalf so a weak spot turns up on a report instead of in an attacker's results.

What a hacked website actually gets used for

A compromised site rarely goes offline. Taking it down would tip you off, so attackers usually keep it running quietly and put it to work instead:

• Serving malware. Visitors get pushed toward a download that installs something they didn't ask for.
• Hosting scam pages. Hidden pages sell fake goods or run scams, borrowing your site's existing standing with search engines to do it.
• Copying form submissions. A contact or checkout form can be altered to capture whatever a visitor types in, including personal or payment details.
• Redirecting visitors elsewhere. Someone clicks your link and lands on a scam or malware site instead of your homepage.

The damage lands on the business whose name is on the site, even though the attacker was really after the visitors passing through it. Search engines flag known-hacked sites and drop their rankings, and browsers can show visitors a warning page in place of your homepage. Either way, the first anyone at the business usually hears about it is from a customer, not from the website itself.

Is your website actually at risk?

It depends entirely on how it's built.

A site on a hosted builder, Wix, Squarespace and Shopify are the common ones, has most of its security and updates handled behind the scenes, so the risk sits mostly with the provider rather than you. A self-hosted WordPress site, usually set up by a designer or agency on its own hosting, is a different situation: keeping WordPress, its plugins and its themes updated is somebody's job, and on a lot of small business sites, the honest answer is that nobody has touched it since launch.

A few signs point to real risk: nobody currently knows who maintains the site, it hasn't been updated in a year or more, or it's running a plugin from a developer who's since gone quiet or stopped supporting it.

A short checklist worth running this week

• Update everything. WordPress, plugins and themes all need updating as new versions land. Many can be set to update automatically.
• Remove what you don't use. Every inactive plugin is still a potential way in. If it's not doing anything, delete it rather than leaving it dormant.
• Stick to well-maintained plugins. Favour ones that are popular, well-reviewed and updated recently, and be wary of anything that hasn't been touched in years.
• Watch for abandoned plugins. A plugin can quietly stop receiving updates, or get pulled from the WordPress plugin store over a security issue. Check every so often that what's running on your site is still actively supported.
• Lock down the admin login. A strong, unique password plus multi-factor authentication, if your setup supports it, makes the login itself far harder to walk through.
• Add a security plugin or web application firewall. A reputable one blocks common attacks automatically and flags anything that changes unexpectedly.
• Keep backups you can actually restore from. If a cyber insurance renewal form is asking whether your business data backups are properly resilient, the same question is worth asking about your website: if it were wiped or held to ransom tomorrow, could you get it back? What "immutable backup" actually means covers the setups that commonly fall short of that.
• Know who's actually responsible. Decide, in writing if needed, whether it's your web designer, your IT provider or your hosting company, so updates are clearly somebody's job rather than nobody's.

That list maps closely onto the same five areas Cyber Essentials asks any UK business to get right, update management, user access, firewalls, secure configuration and malware protection. Most businesses only think to apply that discipline to their office network. It matters just as much for the website sitting in front of every visitor and customer.

If your site is already compromised

• Get help straight away. Cleaning a hacked site properly is a job for your web host, IT provider or a website security service, most have dealt with this many times before.
• Take the site offline. A simple "back shortly" page stops further harm while it's being cleaned up.
• Change every relevant password. From a device you know is clean, change your hosting account and admin logins, and turn on multi-factor authentication if it isn't already on.
• Restore from a clean backup if you have one. It's usually the fastest way back. Without one, the site has to be cleaned by hand, which takes longer and costs more.
• Update everything before going back live. Bring WordPress, plugins and themes fully up to date, and remove anything you don't recognise or no longer use, so the same gap doesn't just get walked through again.
• Tell anyone whose data may have been exposed. If the site handled contact or payment details, check whether any of that was affected and let those people know if it was.

None of this needs your business to be a specific target. The scanning that finds these gaps runs constantly and indiscriminately, which is exactly why a website that's been left alone for a year or two is worth a proper look, not because anyone's coming after you by name, but because the automated tools that are already out there don't need a reason to. If you'd like a second pair of eyes on where your own site and wider systems currently stand, our cyber security team can help, book a call and we'll take it from there.