Most websites get hacked through an ordinary gap, not a clever attack. An out-of-date plugin, a reused password, a login stolen from someone’s inbox or an old admin account gives automated bots a way in. There are seven of these doors, and each has a lock most small businesses can put in place.
Key takeaways
- Small business sites are rarely picked out by a person. Bots scan millions of sites for known weaknesses.
- Software flaws are now the most common way into any business: Verizon’s 2026 report puts them at 31% of breaches.
- On WordPress, 91% of new security flaws in 2025 were in plugins, not WordPress itself.
- Passwords and logins are the other big door. Two-factor login and one account per person close most of it.
- Every door has a matching lock. Most of them are routine maintenance, done every month.
Why would anyone hack a small business website?
Usually, nobody chose your site. Attackers run software that tries the same known weaknesses on every site it can find. If yours has one, it gets in. Wordfence blocked more than 55 billion password attacks on WordPress sites in 2024 alone (Wordfence).
Once inside, they use your site’s good name and server. Common goals are hidden spam pages to game Google, redirects to scam sites, card skimmers on checkout pages and spam email sent from your server. The damage goes well beyond the clean-up bill, as our guide to the cost of a hacked website shows.
What are the 7 doors attackers use most?
Here’s the short version. Each door is explained below in plain English.
| Door | The lock |
|---|---|
| 1. A plugin or theme with a known flaw | Prompt updates, plus a firewall |
| 2. A plugin nobody maintains any more | Remove or replace it |
| 3. A pirated “nulled” plugin or theme | Licensed copies from the real developer |
| 4. A weak or reused password | Long, unique passwords and login limits |
| 5. A login stolen somewhere else | Two-factor login on every admin account |
| 6. Too many people with admin access | One account each, lowest role that works |
| 7. Weak hosting underneath the site | Current PHP, isolated accounts, server security |
1. A plugin or theme with a known flaw
This is the biggest door by far. Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and 91% were in plugins. Only six were in WordPress core. Heavily targeted flaws were mass-exploited within a median of five hours of becoming public (Patchstack).
It isn’t just WordPress. Verizon’s 2026 Data Breach Investigations Report found that exploiting software flaws has overtaken stolen logins as the top way into businesses of every kind, at 31% of breaches (Verizon).
The lock: apply security updates within days, not months. Patchstack also found that 46% of flaws had no fix when they were disclosed, so a firewall that blocks known attacks covers the gap. Our guide to plugin vulnerability alerts explains what to do when one of yours is in the news.
2. A plugin nobody maintains any more
Some plugins stop getting updates because the developer has moved on. Any flaw found after that stays open for good. In 2024, 1,614 plugins and themes were removed from WordPress.org for unpatched security issues (Patchstack 2025 report).
The lock: check when each plugin was last updated, and replace any that look abandoned. Our article on abandoned WordPress plugins shows how to spot them.
3. A pirated “nulled” plugin or theme
A nulled plugin is a paid plugin cracked to skip the licence check, then shared free or cheap. Sucuri says malicious code and backdoors are “routinely injected” into them. Cracked copies also stop receiving security patches, so they age into door number 1 (Sucuri).
The lock: buy licences from the real developer, and ask anyone who builds your site to do the same. See our guide to nulled plugins for how to check what’s installed.
4. A weak or reused password
Bots try common passwords, and passwords leaked from other websites, against login pages all day. Australia’s cyber security agency, ASD, says weak or reused passwords are a common cause of incidents in small businesses (cyber.gov.au).
The lock: a password manager, a unique password of at least 15 characters for every account, and a limit on failed login attempts.
5. A login stolen somewhere else
Sometimes the password is strong but stolen anyway. A fake login page, malware on a staff laptop or a hacked email inbox can hand it over. The inbox matters most, because it can reset the passwords to your website, hosting and domain.
The lock: two-factor login, so a stolen password alone isn’t enough. ASD calls it one of the most effective ways to protect business accounts. Our guide to WordPress two factor authentication shows how to turn it on without locking staff out.
6. Too many people with admin access
Old developers, past staff and agencies often keep admin logins long after the job ends. Shared logins make it worse, because nobody knows who did what. Every extra admin account is another password that can leak.
The lock: one named account per person, the lowest role that does the job, and access removed the day someone leaves. Our guide to website access management includes a simple review you can do in an hour.
7. Weak hosting underneath the site
The server matters too. Old PHP versions stop getting security fixes: PHP 8.2’s security support ends on 31 December 2026 (PHP.net). On cheap shared hosting, one infected site can sometimes spread to others in the same account.
The lock: a current PHP version, each site isolated, and a host that runs a server firewall and malware scanning. Our secure web hosting page sets out what that looks like, and our guide to shared hosting security covers the neighbour problem.
Which door should I close first?
If you only have an afternoon, work in this order. It follows where the most break-ins start.
- Update everything. Take a backup first, then update plugins, themes and WordPress. Check your contact form and checkout afterwards.
- Delete what you don’t use. Remove inactive plugins and themes, and replace anything abandoned or pirated.
- Clean up the accounts. Delete old admin users and downgrade anyone who doesn’t need full control.
- Turn on two-factor login. Start with your email, then your website admin, hosting and domain accounts.
- Ask your host two questions. Which PHP version is the site on, and is it isolated from other sites?
For the full list of hardening steps, work through our WordPress security checklist.
Why do sites with locks still get hacked?
Because locks only work if someone checks them. Sucuri found 39.1% of content management systems were out of date when they were infected (Sucuri report). Most of those owners meant to update. It just slipped.
That’s why we treat security as a routine, not a project. In our experience, the sites that stay clean are the ones where a named person owns updates, accounts and backups every month. Our website security monitoring adds daily malware scans, firewall and login protection, and blacklist checks on top.
If you’d rather hand the whole job over, our website maintenance plans cover monthly updates, weekly high-risk security updates and off-site backups. Sites on Maintain & Protect are covered by our “hack-free or we fix it free” promise.
Frequently asked questions
What is the most common way websites get hacked?
For WordPress sites, it’s a plugin or theme with a known security flaw that hasn’t been updated. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins. Weak, reused or stolen passwords are the next most common way in.
Is my site too small to be hacked?
No. Most attacks are automated, so bots try every site they can reach, whatever its size. A small site still has a server that can send spam, a domain Google trusts and visitors who can be redirected to scams.
Can a website be hacked through the contact form?
It can, if the form plugin has a security flaw. That’s the same as door 1: a vulnerable plugin. Keep form plugins updated, use spam protection and remove any form plugin you no longer use.
Does a security plugin stop all of these?
No. A security plugin helps with logins and known attacks, but it can’t update your other plugins, remove old admin accounts or fix weak hosting. It works best as one layer alongside updates, two-factor login and off-site backups.
How do I know if my website has already been hacked?
Warning signs include unknown admin users, spam pages in Google results, visitors being redirected, a browser warning or a host’s suspension notice. Some hacks stay hidden, so a server-side malware scan is the reliable way to check.
Sources
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- State of WordPress Security in 2026, Patchstack
- 2026 Data Breach Investigations Report news release, Verizon, 19 May 2026
- State of WordPress Security in 2025, Patchstack
- The security risks of using nulled WordPress plugins, Sucuri, 30 March 2026
- Small business cyber security handbook: Securing accounts and identities, Australian Signals Directorate, October 2026
- Supported versions, PHP.net, November 2026
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024