Small business websites rarely get hacked by someone who picked them out. They get hacked by automated scripts that scan millions of websites for the same handful of weaknesses: outdated software, weak passwords, and abandoned plugins. Close those gaps and you're out of reach of almost all of it.
Here's the short list, in order of how much each one matters.
1. Keep everything updated
Most WordPress security holes turn up in plugins and themes, not WordPress itself. Updates exist to close them, and the scanning scripts look specifically for websites that haven't installed those updates.
Updates should happen at least monthly, and sooner for security releases. Someone should check the website after updating, because updates occasionally break things. That's a big part of what an ongoing care plan covers; our piece on what happens after launch goes into the details.
2. Fix the logins
Every person who logs in should have their own account with a long, unique password from a password manager. No shared admin login. No password that's also used for email. Turn on two-factor authentication for every admin account, so a stolen password alone isn't enough to get in.
Remove accounts for people who no longer work with you. Former employees and old contractors with admin access are a common way in, whether through bad intent or a password leaked somewhere else.
3. Backups you've actually tested
Backups should run automatically, daily for websites that change often, and be stored somewhere other than the website's own server. A backup that lives on the same server disappears along with it.
Then test one. Restore it to a staging copy once or twice a year. A backup nobody has ever restored is a hope, not a plan.
4. Fewer plugins, better plugins
Every plugin is code someone else wrote, running on your website. Remove the ones you don't use, and replace any that haven't been updated in a year. Our plugin audit guide walks through it step by step.
5. HTTPS on every page
The padlock in the browser means traffic between visitors and your website is encrypted. It's free with almost every host, and browsers label websites without it "not secure," which scares customers off before they read a word. Make sure every page loads over HTTPS, not only the home page.
6. Good hosting does a lot of the work
Quality hosting includes a firewall that blocks known attacks, malware scanning, and isolation from the other websites on the same server. The cheapest shared hosting often skips all three. The difference in cost is small next to the cost of cleaning up after a hack.
If something looks wrong
Signs of a hack include strange redirects, pages you didn't create, spam links under your domain in search results, or a security warning in Search Console. Don't wait. Change every password, restore a clean backup, update everything, and find the gap that let them in. Skip that last step and they'll be back within days.
None of this needs a security budget. It needs a routine and someone responsible for it. Every WordPress website we build launches with logins, backups, and updates already set up this way.