Most hacked small business WordPress sites aren't targeted. They're found automatically through outdated plugins or weak passwords. A few basic habits prevent most problems.
The essentials
- Keep everything updated: WordPress itself, your theme and every plugin.
- Delete plugins and themes you don't use. Inactive plugins can still be a risk.
- Use strong, unique passwords stored in a password manager.
- Turn on two-factor login for every admin account.
- Give people only the access they need. Not everyone needs to be an administrator.
- Back up daily, and keep backups somewhere other than your web server.
- Use HTTPS on every page.
- Choose decent hosting with malware scanning and firewall protection.
Signs your site may be hacked
- Google shows a warning, or Search Console reports a security issue.
- Pages you didn't create appear in Google, often in other languages.
- Your site redirects visitors to other sites.
- Your host suspends the account.
If it happens
Restore a clean backup, change every password, update everything, and request a review in Search Console once it's fixed. If you don't have a clean backup, get professional help quickly.
Our $79 a month care plan covers updates, backups and monitoring. See website maintenance costs.