Key takeaways
- Australians reported a cybercrime about every six minutes in 2024-25, according to the Australian Signals Directorate (ASD).
- The average reported cybercrime cost a small business $56,600, up 14% on the year before.
- 21% of Australian businesses had a cyber incident in 2024-25, and 28% had no protections in place (ABS).
- Most website attacks target out-of-date plugins, weak logins and missing backups. All three are fixable.
- Eight practical steps, from updates to offsite backups, remove most of the everyday risk.
Cyber security for an Australian small business website comes down to a few habits done consistently: keep software updated, protect logins with two-factor authentication, keep offsite backups, and know who to call when something goes wrong. The numbers below show why it matters, and the checklist shows where to start.
This isn’t about scaring you. Most attacks on small business websites are automated and opportunistic. They succeed because of gaps that are cheap to close.
What does the latest ASD report say about small business?
The ASD’s Annual Cyber Threat Report 2024-25 received more than 84,700 cybercrime reports. That’s about one every six minutes. For small businesses, the average reported loss was $56,600, a rise of 14%.
The most common crimes reported by businesses were email compromise (19%), business email compromise fraud (15%) and identity fraud (11%). Your website is often part of that picture. Contact forms, admin logins and the email accounts tied to your domain are all ways in.
The Australian Bureau of Statistics adds more context. In 2024-25, 21% of Australian businesses had a cyber security incident, and 28% had no preventive measures at all.
“We’re too small to be a target.” Is that true?
It’s a common belief. auDA’s 2026 Digital Lives research found that 38% of small businesses think they’re too small to be targeted. Those businesses were also less likely to use multi-factor login (38% compared with 57%).
The reality is that most attacks aren’t personal. Automated tools scan millions of websites looking for a known weakness, such as an out-of-date plugin. When they find one, they use it. Size doesn’t come into it.
Why are WordPress websites such a common target?
WordPress runs about 39% of all websites, according to W3Techs. That makes it worth attackers’ time. The core software is well maintained, but the plugins around it vary a lot.
Patchstack recorded 11,334 new WordPress vulnerabilities in 2025. 91% were in plugins and only six were in WordPress core. Nearly half had no fix available when they were made public. That’s why keeping plugins updated, and removing ones you don’t use, matters so much.
Eight steps that cut most of the risk
You don’t need an enterprise security team. These eight steps cover the gaps we see most often on small business websites.
- Keep WordPress, plugins and themes updated. Most website hacks use a known flaw that already has a fix. Updates close it.
- Remove plugins and themes you don’t use. Inactive code can still be attacked. If you don’t need it, delete it.
- Turn on two-factor login. A stolen password alone is no longer enough. Do this for every admin, and for your domain and hosting accounts too.
- Use a password manager. Every login gets a long, unique password, so one leak doesn’t unlock everything.
- Keep offsite backups, and test them. If the worst happens, a clean copy stored away from your server gets you back online. See our guide to backing up WordPress.
- Add a firewall in front of your site. It blocks known attacks and password-guessing before they reach WordPress.
- Limit who has admin access. Give staff and contractors only the access they need, and remove it when they leave.
- Know who you’ll call. Write down your host’s support number and an emergency contact before you need them.
What about data breaches and the law?
If your website collects personal information, privacy law may apply when something goes wrong. Under the Notifiable Data Breaches scheme, businesses with an annual turnover over $3 million must notify affected people and the OAIC about eligible breaches.
Some smaller businesses are covered regardless of turnover. These include private health service providers and businesses that handle tax file numbers. If you suspect a breach, you have 30 days to assess it, and serious ones must be reported as soon as practicable.
The OAIC received 1,205 breach notifications in 2025, the highest since the scheme began in 2018. 59% were caused by malicious or criminal attacks. Our guide to what to do after a data breach walks through the steps.
Where to report. Report cybercrime to the ASD at cyber.gov.au/report or call 1300 CYBER1 (1300 292 371). If your website is hacked, our 24/7 emergency line is 0426 833 422.
How much should a small business spend on website security?
auDA’s research found the median small business spends about $500 a year on cyber security. Compare that with the average $56,600 cost of a reported cybercrime.
For a website, the core protections are part of good maintenance. Our Maintain & Protect care plans start at $40 a month + GST. They include regular updates, a firewall, daily malware scans, uptime monitoring and offsite backups, and they’re backed by our guarantee: hack-free, or we fix it free. If you’d rather handle it yourself, the eight steps above are the place to start. Our website security page explains each protection in more detail.
Frequently asked questions
How common are cyber attacks on Australian small businesses?
Very common. The ASD received more than 84,700 cybercrime reports in 2024-25, about one every six minutes. The ABS found 21% of Australian businesses had a cyber security incident that year.
How much does a cyber attack cost a small business?
The ASD’s 2024-25 report put the average self-reported cost at $56,600 per cybercrime for small businesses, up 14% on the previous year.
Is my small business website really a target?
Yes. Most attacks are automated and scan for known weaknesses such as out-of-date plugins. They don’t choose targets by size.
What is the single most important thing I can do?
Keep your website software updated and remove plugins you don’t use. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins.
Does the Notifiable Data Breaches scheme apply to me?
It applies to businesses with turnover over $3 million and to some smaller businesses, including private health providers and those handling tax file numbers. Check the OAIC’s guidance if you’re unsure.
Sources
- Annual Cyber Threat Report 2024-2025, Australian Signals Directorate, released 14 Oct 2025
- Characteristics of Australian Business 2024-25, Australian Bureau of Statistics, 25 Jun 2026
- Digital Lives of Australians 2026, auDA, 2026
- State of WordPress Security in 2026, Patchstack, accessed 13 Nov 2026
- Usage statistics of WordPress, W3Techs, 12 Nov 2026
- Data breach notifications increase to all-time high in 2025, OAIC, 2026