Ten website security myths small businesses still believe
Bad advice is one of the biggest risks to a small website. Here are the beliefs we hear most often, and what the evidence says.
1. “We’re too small to be a target.”
Reality: Robots don’t check your size. UK small firms report breaches at nearly the same rate as the overall average (46% against 43%).1 Small sites are often easier to get into because nobody is watching.
2. “My hosting company handles security.”
Reality: Most hosts protect their servers, not the software on your site. In Patchstack’s testing, 87% of website attacks got straight past typical hosting defences.2
3. “I’ve got the padlock, so I’m secure.”
Reality: The padlock (SSL) means the connection is private. It says nothing about whether the site itself has been hacked. Scam sites have padlocks too.
4. “There’s nothing on my site worth stealing.”
Reality: Your Google ranking, your visitors, your email reputation and your server are all worth money to criminals. See why small sites get hacked.
5. “I’d know if I’d been hacked.”
Reality: Most hacks are designed to be invisible to the owner. Many owners first hear about it from a customer, their host or a Google warning. Here are the signs to look for.
6. “I keep everything updated, so I’m fine.”
Reality: Updating is vital, but attackers now move within hours of a flaw going public,3 and sometimes before a fix exists.4 In the April 2026 plugin backdoor, the update itself was the attack.5
7. “A security plugin makes my site safe.”
Reality: Security plugins help, but they are more software running inside the thing they guard, and they can have holes of their own. Fewer moving parts beats more locks.
8. “A strong password is enough.”
Reality: Passwords get stolen from your computer, not just guessed. Two-step login cuts the risk of account takeover by over 99%, according to Microsoft research.6 Only 43% of UK micro businesses require it.1
9. “Wix and Squarespace sites can’t be hacked.”
Reality: Builders do patch their own software, which is a real advantage. But your account, your domain and your email can still be taken over, and you are renting a site you can’t easily move.
10. “60% of small businesses close within six months of a cyber attack.”
Reality: You’ll see this everywhere, but nobody can find where it came from. The US National Cyber Security Alliance, often named as the source, has said it isn’t theirs.7 The real risks are serious enough without made-up numbers, which is why every figure on this site has a source.
Sources
-
UK Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025/2026. ↩ ↩2
-
Patchstack, Hosting security tested: 87% of vulnerability exploits bypassed hosting defences. ↩
-
Patchstack, State of WordPress Security in 2026. ↩
-
Mandiant, M-Trends 2026, via Security Boulevard. ↩
-
TechRepublic, Malicious WordPress plugins with backdoors compromise thousands of websites (April 2026). ↩
-
Microsoft Research, How effective is multifactor authentication at deterring cyberattacks? ↩
-
National Cyber Security Alliance, Statement regarding incorrect small business statistic. ↩
Common questions
Does my hosting company protect my website from hackers?
Most hosts protect their own servers, not the software on your site. In Patchstack's testing, 87% of website vulnerability exploits got past typical hosting defences.
Does HTTPS mean my website is secure?
No. The padlock (SSL or HTTPS) means the connection between the visitor and your site is private. It says nothing about whether the site itself has been hacked.
Do 60% of small businesses close after a cyber attack?
There is no known source for that figure. The National Cyber Security Alliance, often named as the source, has said the statistic isn't theirs.
Want all of this in one place?
Our free plain-English guide covers every topic in this library, with five easy wins you can do today. We'll email it to you.
Email me the free guide