Website Security for Small Business: A Practical Checklist

"Who would hack a small business?"

Bots would. Attacks on small sites are rarely personal: automated scanners crawl the web looking for known vulnerabilities and weak logins, and every site that matches gets hit. A hacked site can send spam from your domain, redirect visitors to scams, leak form submissions and get flagged by Google as dangerous.

Where the holes usually are

Patchstack's State of WordPress Security in 2025 report counted 7,966 new vulnerabilities in the WordPress ecosystem during 2024. 96% of them were in plugins, 4% in themes and only seven in WordPress core. The report also found that 33% of vulnerabilities had no fix available at the time of public disclosure, and 43% could be exploited without logging in.

The lesson is not "WordPress is unsafe" — it is that every plugin you install is code you are responsible for, whatever platform you use.

The checklist

• Update regularly. Core, themes, plugins and server software. Schedule it — monthly at minimum, immediately for critical security releases.
• Remove what you don't use. Deactivated plugins and old test copies of the site still sit on the server.
• Buy plugins from maintained sources. Check the last update date and how fast the developer reacts to security reports.
• Unique passwords and two-factor authentication for the admin panel, hosting, domain registrar and email. The registrar is often forgotten — whoever controls the domain controls the site.
• Separate accounts with minimal rights. A content editor doesn't need administrator access; a former contractor doesn't need any access.
• HTTPS everywhere, with automatic certificate renewal.
• Backups stored off the server, daily for active sites — and tested. A backup you have never restored is a hope, not a backup.
• Protect forms with spam protection and server-side validation; never trust what arrives from the browser.
• Monitoring. Uptime alerts and Google Search Console notifications tell you about a problem before your clients do.

Custom code is not automatically safer

A custom Next.js site has fewer third-party plugins, which removes a whole class of risk. But it still has dependencies, an admin panel and API routes. The same rules apply: update dependencies, check access rights and keep secrets out of the code.

Make someone responsible

Security fails most often because nobody owns it after launch. Whether it is your team or your studio, one person should be responsible for updates, backups and access.

Platform choice affects how much of this checklist you carry: compare the upkeep in WordPress vs Next.js for a business website, and see how an AI agent can probe a site in the Academy guide to AI pentesting with Shannon. If nobody on your side owns updates and backups, that is what our website support and maintenance covers.

Not sure how safe your site is? Codearia offers maintenance plans with updates, backups and monitoring — contact us for a quick security review.