Most small business websites are not hacked by a clever attacker. They are hit by automated tools hunting known flaws. Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem in 2025, and heavily exploited ones were attacked a median of 5 hours after disclosure. Verizon found exploited vulnerabilities were the top known way into breaches in 2026. This checklist covers what to fix, in what order.
Why small business websites get attacked
Attackers scan the whole internet for known weaknesses and exploit them in bulk, so size offers no cover. Verizon's 2026 DBIR found that exploited vulnerabilities were the leading known initial access vector at 31% of breaches, up from 20%, and that organisations fully fixed only 26% of the most critical known exploited vulnerabilities, taking a median of 43 days to patch.
Websites are also a route to visitors. In IBM's 2026 India data, drive-by compromise, where users are infected by visiting a malicious or hacked site, was the starting point for 16% of breaches. Indian threat reports also list website defacement alongside DDoS and phishing as common attack types. A hacked site harms your customers and your search ranking, not just your own data.
1. Software, plugins and updates
For sites built on a content management system, the risk sits mostly in add-ons. Patchstack found that 91% of new WordPress vulnerabilities in 2025 were in plugins and 9% in themes, while core had only six reported issues. About 17% were high severity and likely to be used in automated mass attacks, and 46% had no fix available from the developer at the time of public disclosure.
That last figure matters: updating is necessary but not always enough. Remove plugins you do not use, prefer actively maintained ones, and have a way to disable or virtually patch a vulnerable component while you wait for a fix. Custom sites face the same issue with open source libraries.
- Turn on automatic updates for core and trusted plugins
- Delete unused plugins, themes and test copies of the site
- Check plugins for recent updates before installing
- Subscribe to vulnerability alerts for components you use
- Patch high-severity issues within a day where possible
2. Admin accounts and access
Broken access control is first on the OWASP Top 10:2025, and authentication failures are seventh. On a small site that usually means shared admin passwords, old accounts for former staff or agencies, and admin panels open to the whole internet.
Give each person their own account with the lowest role that works, turn on multi-factor authentication for every admin, and remove accounts the day someone leaves. Limit login attempts, and where your host allows it, restrict the admin area to known IP addresses or put it behind single sign-on. Third parties were involved in 48% of breaches in the 2026 DBIR, so review agency and plugin vendor access too.
- One named account per person, no shared logins
- MFA on every admin, hosting, DNS and domain registrar account
- Remove former staff and agency accounts immediately
- Rate limit or lock out repeated failed logins
- Keep hosting and registrar accounts on a separate, protected email
3. HTTPS and certificate renewal
HTTPS is standard, but certificate lifetimes are shrinking, which makes manual renewal risky. Under CA/Browser Forum ballot SC-081v3, approved on 11 April 2025, the maximum validity of public TLS certificates fell to 200 days from 15 March 2026, and will fall to 100 days in March 2027 and 47 days in March 2029.
If you still renew certificates by hand once a year, plan to automate renewal with the ACME protocol, which most hosts and certificate authorities support. Redirect all HTTP traffic to HTTPS, enable HSTS once you are confident every subdomain works over HTTPS, and monitor expiry dates so an outage does not catch you out.
| Certificates issued from | Maximum validity | Domain validation reuse |
|---|---|---|
| 15 March 2026 | 200 days | 200 days |
| 15 March 2027 | 100 days | 100 days |
| 15 March 2029 | 47 days | 10 days |
4. Checks for custom-built sites: the OWASP Top 10:2025
If your site or web app is custom code, use the OWASP Top 10:2025 as the review list for your developers. It is built from data on more than 2.8 million applications plus a community survey. New this edition are software supply chain failures, which expand the old outdated components category, and mishandling of exceptional conditions. Server-side request forgery is now part of broken access control.
Ask your developers or agency to show how each item is handled in your code, and include the list in the acceptance criteria for all new work and in any annual security review. The table gives a plain-language check for each category.
| OWASP 2025 category | Plain-language check |
|---|---|
| A01 Broken Access Control | Can a user see or change another user's data by editing a URL or ID? |
| A02 Security Misconfiguration | Are debug modes, default accounts and directory listings switched off? |
| A03 Software Supply Chain Failures | Are libraries tracked, updated and from trusted sources? |
| A04 Cryptographic Failures | Is sensitive data encrypted in transit and at rest? |
| A05 Injection | Are all inputs validated and database queries parameterised? |
| A06 Insecure Design | Were abuse cases considered before building features? |
| A07 Authentication Failures | Is MFA available and are sessions handled safely? |
| A08 Software or Data Integrity Failures | Are updates and build pipelines verified? |
| A09 Security Logging and Alerting Failures | Do logins and errors get logged and alerted on? |
| A10 Mishandling of Exceptional Conditions | Does the app fail safely without leaking details? |
5. Backups, logging and monitoring
Assume something will go wrong and make recovery boring. Keep automatic daily backups of files and database, store at least one copy away from the hosting account, and test a full restore every quarter. Backups held only on the same server are lost with it.
Logging and alerting failures made the OWASP list through the community survey because breaches often go unnoticed for months. Keep access and error logs, alert on new admin users and file changes, and use uptime monitoring so you hear about defacement or downtime before customers do. IBM found 53% of breached organisations did not encrypt sensitive data, so encrypt backups too.
- Daily automated backups with one off-site copy
- Quarterly restore test to a staging site
- Encrypted backups and database exports
- Alerts for new admin accounts and changed files
- Uptime and certificate expiry monitoring
6. Hosting, firewalls and third-party scripts
Choose hosting that isolates sites, patches the server for you and offers a web application firewall. Do not assume generic protection covers everything: in Patchstack's tests, traditional defences blocked only 12% of WordPress-specific vulnerability attacks in a first round and 26% in a second, wider test. Application-aware rules or virtual patching close more of that gap.
Every external script, chat widget or tag on your pages runs with your site's trust. Keep a list of them, remove the ones you no longer use, and load them only from their official sources. This is the website version of the supply chain risk that OWASP now ranks third.
7. Test what you own, regularly
A checklist tells you what should be true; a test tells you what is. Run a vulnerability scan of your own site after each major change, and commission an authorised penetration test of internet-facing systems at least once a year. Only test systems you own or have written permission to test.
Testing has a measurable return. In IBM's 2026 India data, offensive security testing such as penetration testing and red teaming was the largest cost-reducing factor, saving an average of ₹2.47 crore per breach. XDQ Labs offers authorised testing with fixes and re-verification for small business sites and web apps.
Frequently asked questions
What is the most important website security step for a small business?
Keep software updated and remove what you do not use. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins, and heavily exploited ones were attacked a median of 5 hours after disclosure. Pair automatic updates with MFA on every admin account and tested off-site backups.
How often do SSL certificates need renewing in 2026?
Certificates issued from 15 March 2026 can be valid for at most 200 days. The limit falls to 100 days from 15 March 2027 and 47 days from 15 March 2029 under CA/Browser Forum ballot SC-081v3. Automate renewal through your host or the ACME protocol to avoid outages.
What is in the OWASP Top 10 2025?
The list is: broken access control, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software or data integrity failures, security logging and alerting failures, and mishandling of exceptional conditions. Supply chain failures and exceptional conditions are the notable additions.
Does a small website need a web application firewall?
It helps, but choose one that understands your platform. In Patchstack's tests, traditional defences blocked only 12% of WordPress-specific vulnerability attacks in one round and 26% in another. Use application-aware rules or virtual patching, and keep updating software, since a firewall is a backstop, not a fix.
Sources
- OWASP Top 10:2025 Introduction, OWASP Foundation, 2025
- Industry to shift to 47-day SSL/TLS certificate validity by 2029, The SSL Store, 2025
- State of WordPress Security in 2026, Patchstack, 2026
- Verizon Data Breach Investigations Report 2026, CyberScoop, 2026
- 2026 Verizon DBIR reveals new attack vectors and 8 ways organizations can protect themselves, Secureframe, 2026
- IBM Report: India's Average Data Breach Cost Hits Record INR 25.5 Cr, Entrepreneur India, 2026
- IBM 2026 Cost of a Data Breach Report: key findings, eSecurity Planet, 2026
- Verizon DBIR 2026: vulnerability exploitation, third-party risk and compliance, ComplianceHub, 2026
- India records over 265 million cyberattack attempts, report highlights rising cyber threats, Telangana Today (IANS), 2026
