Website safety library

Website security, in plain English.

Eleven short guides for owners, not IT people. Every claim backed by a named, recent report. Start with the quiz if you'd like to know where your own site stands.

Take the 2-minute quiz Get the free PDF guide

11,334: new security holes found in WordPress add-ons and themes in 2025
5 hrs: typical time from a serious flaw going public to robots attacking sites with it
46%: of UK small businesses found a breach or attack in the past year

Sources: Patchstack, 2026; UK Cyber Security Breaches Survey 2025/26.

Understand the threat

Who is attacking small sites, how, and why size no longer protects you.

Why small business websites get hacked Nobody sits down and decides to hack a plumber in Leeds or a physio in Hamilton. Robots do it, by the million, because it pays. 6 min How AI changed hacking for small businesses AI hasn't invented new crimes. It has made the old ones cheaper, faster and far more convincing. When an attack costs almost nothing to run, every website is worth attacking. 6 min What a hacked website really costs a small business The clean-up bill is usually the smallest cost. The bigger costs come later, from lost enquiries, a damaged reputation and time you'll never get back. 5 min Ten website security myths small businesses still believe Bad advice is one of the biggest risks to a small website. Here are the beliefs we hear most often, and what the evidence says. 6 min

Check your site

Quick ways to spot trouble and find the doors you have open.

Signs your website has been hacked A hacked site often looks perfectly normal to its owner. Here are the hacks we see most on small business websites, and the clue each one leaves. 7 min Your easy website safety checklist Grab a coffee and work down this list. Each line takes a few minutes, and together they close the doors used in most small-business break-ins. 4 min

Fix and prevent

Plain steps for WordPress, any other platform, and the devices you log in from.

The WordPress security checklist for small businesses WordPress runs about 4 in 10 websites. That popularity is exactly why it's the most attacked system on the web. Here's how to close the doors that matter. 7 min Website security best practice for any small business Whatever your site runs on, the same handful of habits stop most attacks. Most of them are about accounts, not code. 6 min How a laptop hack becomes a website hack Many website hacks don't start with the website at all. They start on the laptop or phone you use to log in to it. 5 min Static site vs WordPress: which is more secure? Every lock in website security guards a door. The safest door is the one that isn't there. 6 min Website hacked? What to do in the first hour Don't panic, and don't delete anything yet. Here's the order to do things in, written for owners rather than IT people. 5 min

Free · about 2 minutes

Is your website safe? Find out in 2 minutes.

The questions change with your answers, so you only see what applies to your site. You get a safety score out of 100 on screen, then a full report by email with fixes for your platform.

Scores for software, logins, backups and hack history
Step-by-step fixes for WordPress, Wix, Squarespace and more
No sales call. Your details are never shared.

Start the 2-minute safety quiz

Answer a few plain questions and get a safety score out of 100 straight away, then a full report by email.

Start the quiz

Opens our secure form in a new tab.

Recently, in the news

It isn't only WordPress.

Builders like Wix, Squarespace and Weebly handle updates for you, but you're renting your site. When they change prices or close down, you have little choice.

Oct 2026

The software behind WordPress was attacked worldwide

PHP2Shell · confirmed by the US cyber agency CISA

Every WordPress site runs on PHP. Two serious holes were patched on 21 October and were being used in attacks within a week.

Source: The Hacker News, BleepingComputer
Sep 2026

Weebly began taking sites offline in 67 countries

Sites unpublished from 27 September

Owners were told to download their content before losing access. A site you rent goes wherever the platform goes.

Source: Khaleej Times
Sep 2026

A WordPress backup add-on left about 3.2 million sites exposed

All-in-One WP Migration

A fix was out, but only around a third of sites had installed it.

Source: SecurityWeek
Jul 2026

Squarespace put prices up by as much as 26%

Applied at each customer's next renewal

Its most popular plan went from $23 to $29 a month on annual billing.

Source: PetaPixel
May 2026

A WordPress design add-on let attackers take over websites

Kirki plugin · rated 9.8 out of 10 for severity

A bug in password reset let attackers become the site's administrator without a password.

Source: BleepingComputer
Apr 2026

A buyer of 31 WordPress plugins hid a backdoor in all of them

Dormant for eight months before switching on

Owners who kept everything updated still got it, because the update itself was the attack.

Source: TechRepublic