Most Hacked Small-Business Websites Weren't Targeted. They Were Out of Date.

Not targeted, just out of date

WordPress's own Hardening WordPress guide says the most common attacks fall into two groups: requests aimed at "specific vulnerabilities," which "include old/outdated plugins and software," and "brute-force" guessing of logins. It also notes that "many WordPress attacks are carried out autonomously by malicious software bots." In other words, the bot doesn't care whose site it is. It cares what version you're running.

The guide explains why old versions are risky: once a fix ships, "the information required to exploit the vulnerability is almost certainly in the public domain." Updating closes that door. Skipping updates leaves it open after the instructions to open it have been published.

What the research shows

A few numbers from primary sources, with what they do and don't mean:

Plugins are where the holes are. Patchstack's State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% from 2024. 91% were in plugins, 9% in themes, and only six were in WordPress core, all low priority. That's a count of reported flaws, not hacked sites.

Some fixes don't exist yet. The same report says 46% of vulnerabilities "did not receive a fix from the developer in time for public disclosure." So updating isn't always enough. Sometimes the right move is removing or replacing the plugin.

Outdated software shows up in cleanups. Sucuri's 2023 Hacked Website & Malware Threat Report found that 39.1% of CMS installs were outdated at the point of infection, and 13.97% of compromised sites had at least one vulnerable plugin or theme when they were cleaned. Sucuri also found that 49.21% of compromised sites had at least one backdoor, which is why a quick "delete the bad file" cleanup often isn't the end of it. Sucuri notes the data covers sites its team serviced and "does not represent the entire web."

Government guidance says the same thing. CISA lists "Update Business Software" as one of four essentials on its Secure Your Business page, warning that threat actors "actively look for open vulnerabilities, like weak credentials or outdated software." Its Update Software page puts it simply: "Malicious online criminals won't wait, so we shouldn't either!"

What isn't known: none of these sources can tell you the odds that your particular site gets hit this year. Vulnerability counts measure reported flaws, and cleanup reports only cover sites that got cleaned. Treat the numbers as a reason to keep a routine, not as a forecast.

The monthly website checklist

Set a recurring 30-minute block on the calendar. Work through this list in order.

Take a backup first, and know you can restore it. WordPress's upgrade guide says to back up before updating and to "verify the backups you created are there and usable. This is essential." At least once a quarter, actually restore a backup to a test copy. We walk through that in website backups need a restore rehearsal.

Update the CMS core. WordPress says "older versions of WordPress are not maintained with security updates." Minor security releases update automatically on most sites by default. Check that you're on the current version anyway.

Update plugins. Check the update list and apply anything pending. For a plugin that hasn't had an update in a long time, look it up before keeping it.

Update themes, including the ones you aren't using. An inactive theme is still code sitting on your server.

Delete what you don't use. WordPress's guidance is direct: "if you are not using a specific plugin, delete it from the system." Deactivated isn't the same as deleted. Our post on pruning old WordPress sites covers how to decide what goes.

Review admin accounts and use least privilege. Open the Users screen. Remove former employees, old contractors and test accounts. WordPress's Roles and Capabilities page shows that Administrators can install and edit plugins and themes. Someone who only writes blog posts needs Author or Editor, not Administrator. Avoid obvious admin usernames like "admin" or "webmaster," which the hardening guide says "are typically subject to attacks first."

Turn on multifactor authentication. WordPress recommends two-step authentication in addition to a strong login, and CISA calls MFA an essential, recommending phishing-resistant MFA where available. Do the same for your hosting, domain registrar and email accounts. If you've ever been locked out, our MFA lockout guide shows how to set up recovery options first.

Check hosting and PHP version. Your site runs on PHP, and PHP versions expire. The PHP project's Supported Versions page shows 8.2 gets security fixes only until December 31, 2026, while 8.3, 8.4 and 8.5 are supported longer. It warns that end-of-life versions "may be exposed to unpatched security vulnerabilities." Most hosts let you switch PHP versions in the control panel, but test first, because older plugins sometimes break. See our PHP security update post for more.

A few habits that make the checklist easier

Turn on automatic updates where it's safe. WordPress says new installs since 5.6 get major and minor core updates automatically, and plugin and theme auto-updates can be switched on per item. For a simple brochure site, auto-updating well-maintained plugins is usually less risky than waiting.

Get plugins from trusted sources. The hardening guide says to stick to the official WordPress plugin directory or well-known companies. Patchstack found premium marketplace components harder for researchers to review, which is another reason to keep the list short.

Know who owns what. If an agency or freelancer built the site, confirm you hold the admin, hosting and domain logins. Our website ownership checklist walks through it.

Write down what "normal" looks like. A short list of plugins, admin users and the PHP version makes it easy to spot something new next month.

If you think it already happened

Spam pages in Google, redirects, or an admin user you don't recognize are signs to act now. Don't start with a plugin update. Follow our hacked website and Search Console takeover checklist first, and keep in mind Sucuri's finding that backdoors are common after an infection.

How Local Business Search can help

Local Business Search offers website care and small-business IT. We can run this monthly checklist for you: updates, plugin cleanup, backup and restore tests, admin reviews, MFA setup, and PHP and hosting checks. We'll send a short plain-English note each month on what changed. We also help with AI setup and consulting and build websites that are easier to maintain. Done-for-you how-to videos are coming soon.