WordPress security checklist for small business sites (2026)

Small sites get hacked not because someone chose them, but because bots scan millions of sites for known holes. The numbers from Patchstack’s State of WordPress Security in 2026 report make the priorities clear:

• 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, 42% more than the year before.
• 91% were in plugins, 9% in themes. WordPress core had only 6, all low priority.
• 46% had no fix available when they were made public.
• For the most attacked flaws, the typical time from disclosure to the first attack was about 5 hours.

So the job is mostly about plugins, and about speed.

The checklist

Updates

• Turn on automatic updates for WordPress core and for plugins you trust. For a shop or booking site, update on a staging copy first, but do not wait weeks.
• Delete plugins and themes you do not use. Deactivated is not enough: the files are still there.
• Replace plugins not updated for over a year or removed from the WordPress directory. A closed plugin will never be fixed.
• Never install “nulled” (pirated) themes or plugins. They very often contain a backdoor.
• Keep PHP on a supported version. PHP 8.2 stops getting security fixes on December 31, 2026.

Logins

• Every admin uses a unique, long password from a password manager.
• Two-factor login on WordPress admin, the hosting account and the domain registrar. The registrar matters: whoever controls the domain controls your website and email.
• Only the people who need admin have admin. Editors and shop managers get lower roles.
• Remove accounts of former staff and agencies.

Backups

• Automatic daily backups stored somewhere other than the website’s server.
• Test a restore once. A backup you have never restored is a hope, not a backup.

Email from your domain

• Set up SPF, DKIM and DMARC for your domain. Since 2024 Gmail and Yahoo, and since 2025 Outlook.com, require them for bulk senders and treat unauthenticated mail with suspicion. Even small senders benefit, and it stops others from sending email that pretends to be you.

Watching

• Add your site to Google Search Console. It warns you about hacked content and malware.
• Use a security or vulnerability-alert plugin that tells you when an installed plugin has a known flaw.

If you think you were hacked

Do not just restore an old backup and move on: if the hole is still open, the attacker comes back. Change all passwords, find how they got in, clean the site, update everything, then ask Google to review it. My guide on websites that redirect to spam explains the safe first steps.

Where I can help

I can review your site against this list and send a written report: which plugins are risky, what is missing, and what to fix first. Describe your site and you get a fixed price before I start.