Website security for local businesses: the short list that matters

Short answer: most local business websites aren't hacked by someone who's after them. They're hit by automated attacks on known holes in out-of-date software, and by stolen or reused passwords. A short list covers most of the risk: run less software, keep what's left updated, put two-factor logins on everything, keep your domain locked and in your name, and keep backups you've actually tested.

Website security gets sold as either a terrifying mystery or a £30 plugin. It's neither. It's a handful of dull habits, done every week, by someone who knows they're their job.

Nobody's hacking your website personally. A script is trying every door on the street, and it only needs one left open.

How often it actually happens

• 43%of UK businesses identified a cyber breach or attack in the previous 12 months. That's 42% of micro businesses and 46% of small ones.
• 38%of businesses were hit by phishing, by far the most common attack.
• 5%of businesses hold Cyber Essentials, the government-backed baseline certification.

Source: Cyber Security Breaches Survey 2025/26, DSIT, published 30 April 2026. It only counts attacks businesses noticed, so the real figure is likely higher.

For WordPress sites, the picture is sharper. Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before. 91% were in plugins, and only six were in WordPress itself. 46% had no fix available from the developer by the time they were made public, and the most heavily targeted ones were being exploited a median of five hours after disclosure.

Source: Patchstack, State of WordPress Security in 2026.

Five hours. That's why "I'll update it when I get a minute" doesn't work, and why the plugin you installed for one job three years ago is the biggest risk on the site.

Seven things that cover most of the risk

1. Run less software

Every plugin, theme and add-on is another door. Delete the ones you don't use. Deactivating isn't enough, because the files stay on the server. If a plugin hasn't been updated by its developer in a year, replace it.

It's also one reason our Zenlio Local sites are static: there's no database and no admin login on the live site for anyone to try. That isn't the right answer for everyone, and plenty of businesses want WordPress so they can edit things themselves. It just means fewer doors.

2. Update every week, not when you remember

WordPress, themes and plugins, every week. Ideally tested on a copy of the site first, so an update doesn't break the contact form on a Friday afternoon. If nobody is doing this for you, assume it isn't being done.

3. Lock down every login

• A different password for every account, kept in a password manager
• Two-factor logins on your hosting, domain registrar, email, website admin and Google Business Profile
• Old staff, freelancers and previous web designers removed. If you don't know who still has access, that's the first job

4. Own your domain, and lock it

Your domain should be registered in your name, with your email address on it, auto-renewal on and a registrar lock switched on. Losing a domain is worse than losing a website, because your email goes with it. We cover the details in domain, hosting and email, explained, and what to do if someone else holds the keys in web designer disappeared.

5. Back up off-site, and test the restore

Daily backups, stored somewhere other than your web host, kept for at least 30 days. Then, once in a while, actually restore one to a test copy. A backup you've never restored is a hope, not a plan.

6. HTTPS everywhere, plus a few security headers

The padlock is the minimum. Behind it, a few response headers tell browsers how to behave: always use HTTPS, don't let other sites load yours in a frame, and limit what scripts can run. On our own site that's HSTS, X-Frame-Options, Referrer-Policy and a content security policy. Your developer can set these up in under an hour.

7. Protect your email domain

Phishing is the most common attack, and some of it will pretend to be you. Three DNS records (SPF, DKIM and DMARC) make it much harder for someone to send email that looks like it came from your domain. Your email provider has a guide for each.

Signs your site's already been hacked

• Visitors on phones get sent to a strange site, but it looks fine on your computer
• Google shows "This site may be hacked" under your listing
• A search for site:yourdomain.co.uk shows pages you didn't write, often in another language or selling pills
• New admin users you don't recognise
• Your host suspends the site, or your emails start bouncing as spam

If any of those sound familiar, read what to do in the first hour before you touch anything. We also do a fixed-price hacked site clean-up.

Who should be doing this?

Somebody named. That's the honest answer. Most neglected websites aren't neglected on purpose. Everyone assumes someone else is keeping an eye on them. If it's you, block out 15 minutes a week. If it's your web designer or host, ask them to show you, in writing, what they check and how often. If nobody can answer, a WordPress care plan is cheaper than a clean-up. The 10-minute WordPress health check shows you where you stand right now, and our free WordPress site checker gives you an outside view in ten seconds.

For the wider business, not just the website, the National Cyber Security Centre's Small Business Guide is free, short and written in plain English.

Keep reading: Free WordPress site checker