Why would anyone attack a small business website?
Nobody has to choose your website for it to be attacked. Most attacks are run by programs that scan the whole internet, around the clock, for any site with an outdated plugin or a guessable password. When they find one, the site itself is the prize: its search ranking for spam, its visitors for phishing and malware, its checkout for card numbers, its mail server for spam, and its data for ransom. The threat is the same everywhere in the world, and the defences that stop most of it are within reach of any business.
Nobody chose your website: a program did
The UK National Cyber Security Centre (NCSC) divides attacks into targeted and untargeted. Untargeted attacks go after as many systems as possible, whoever owns them, by "attacking wide swathes of the Internet at random". Every organisation online should expect them.
Size does not protect anyone. The NCSC's guide for small organisations, revised in 2026, puts it bluntly: if you think your business is too small to be a target, think again. The UK government's 2026 Cyber Security Breaches Survey found that 46% of small businesses had a breach or attack in the previous twelve months, close to the figure for all businesses.
The reason is automation. Attack tools can test thousands of websites a minute. Testing yours costs the attacker nothing, so there is no reason to skip it.
What a criminal gets from a small website
Your search ranking
A website that Google trusts is valuable to spammers. Attackers hide pages and links for pharmacies, gambling or counterfeit goods inside hacked sites, sometimes shown only to search engines. The security company Sucuri found search engine spam on 38% of the infected sites it detected in 2024.
Your visitors
A hacked site can host phishing pages that borrow its good name, or show visitors a fake "update your browser" or "verify you are human" prompt that installs malware. Google lists these among the most common kinds of hacked content.
Your checkout
On an online shop, attackers plant code that copies card details as customers type them. Sucuri found these card skimmers on more than 18,000 sites in 2024, mostly WooCommerce and Magento shops.
Your mail server
A hacked site can be made to send spam through your hosting account. Apart from the harm to strangers, it damages your domain's reputation, and your own legitimate email starts landing in spam folders.
Your data, and your business
Customer lists, orders and logins are worth money on their own. And for small organisations, ransomware dominates: Verizon's 2025 Data Breach Investigations Report found ransomware in 88% of breaches at small and medium businesses, against 39% at large organisations. Verizon's 2026 summary found the attackers of small businesses were all outsiders and all after money.
How they get in
Outdated plugins and themes
Software flaws are now the most common way in. Verizon's 2026 summary puts exploited vulnerabilities at the top of the list of first steps in a breach. For WordPress sites, the flaws are almost all in add-ons. The security company Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes and just six in WordPress itself.
The speed is what catches people out. Patchstack found that about half of the most serious flaws were attacked within 24 hours of being made public, and nearly half had no fix available yet when they were disclosed. Old flaws stay dangerous too: only four of the ten most attacked WordPress flaws of 2025 were discovered that year. The rest were older ones on sites that had not been updated.
Guessed, reused or stolen passwords
Login pages are attacked constantly. The security company Wordfence blocked 16 billion password attacks on WordPress sites in the first three months of 2026 alone. Most are credential stuffing: trying username and password pairs leaked from other websites, in the hope that someone reused them.
Increasingly, the password comes from the owner's own computer. Sucuri reports a rise in hacks using administrator and hosting logins stolen by malware on site owners' devices. Our article on infostealer malware explains how that happens.
What it costs when it happens
- Google warnings. Google may label your site "This site may be hacked" in search results, or show visitors a full-page warning. Google says many of the unsafe sites it finds each day are legitimate sites that were compromised. Removing the warning means cleaning the site and waiting days to weeks for a review.
- Email problems. If your domain was used to send spam, mail providers may block your genuine mail too.
- Time and money. Clean-up, restoring from backup, telling customers, and possibly reporting to the Information Regulator if personal information was exposed.
Five things that stop most of it
- Update everything, every week. WordPress, themes and plugins. Turn on automatic updates where you can.
- Remove what you do not use. Every inactive plugin and theme is code an attacker can still reach.
- Use unique passwords and two-factor authentication for the website, the hosting panel and email. Our help article covers two-factor authentication in WordPress.
- Keep backups you have tested, stored away from the site.
- Protect your domain's email with SPF, DKIM and DMARC records, so criminals cannot easily send mail in your name.
Our WordPress security checklist and our article on WordPress security myths go further.
What we do, and what is yours to do
On Noiz shared hosting, the work is split. Noiz runs, patches and watches the servers: the operating system, the control panel, the web and database servers, mail filtering, certificates and a weekly backup kept off site. A web application firewall refuses known attack patterns, and attempts to log in to WordPress are limited per address. Your website itself, its code, themes and plugins, and keeping them updated, stay with you.
If you would rather hand that part over, WordPress Care updates WordPress, themes and plugins every week with a restore point taken first, scans for known plugin and theme vulnerabilities and patches them as fixes are released, and includes hack fix and recovery if the worst happens. The Email Security add-on keeps your domain's SPF, DKIM and DMARC configured. Add either from the client area, or open a ticket and ask which fits your site.
Sources
Checked 19 October 2026.
Government and official statistics
- NCSC, Common cyber attacks: reducing the impact (PDF)
- NCSC, Small organisations guide to cyber security
- UK government, Cyber Security Breaches Survey 2025/2026
- OWASP, Automated threats to web applications
Vendor reports
- Verizon, 2026 Data Breach Investigations Report: executive summary (PDF)
- Verizon, 2025 Data Breach Investigations Report (PDF)
- Patchstack, State of WordPress Security in 2026
- Wordfence, Quarterly WordPress threat intelligence report, Q1 2026
- Sucuri, 2024 SiteCheck threat report (PDF)
- Google, Spam policies for Google web search
- Google, Help for hacked sites
- Google Safe Browsing transparency report
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
