Why small business websites get hacked

Hacking a website today is mostly automated. Programs scan the whole internet around the clock looking for any site running software with a known hole, a weak password, or a login page they can guess. They don’t check who you are first. If your site matches what they’re looking for, they get in.

You aren’t a target. You’re a match.

The scale is hard to picture. One WordPress security company, Wordfence, blocked 18.2 billion password-guessing attempts on the sites it protects in the second quarter of 2026 alone.¹ That’s about 200 million a day, and it only counts the sites that one firm watches.

How fast the robots move

When a serious security hole is found in a popular WordPress add-on, the details are published so owners can update. The same notice tells criminals exactly what to look for. Patchstack found the typical time between a heavily targeted hole going public and robots attacking websites with it was five hours.²

That is faster than most owners read their email. It’s also why “I’ll update it when I get a chance” doesn’t work any more.

What a small site is worth to a criminal

Your site might not hold credit cards, but it has things criminals can sell or use:

• Your Google reputation. Hackers hide thousands of spam pages on trusted local sites to push fake shops, gambling and pills up the search results. Sucuri found this kind of spam on 422,741 sites in a single year.³
• Your visitors. A hacked site can quietly send people to scams or infect their computers. Your customers trust your name, so they click.
• Your email name. A hacked server can send thousands of phishing emails that look like they came from you.
• Your contact form. Every enquiry holds a name, a phone number and sometimes health or money details.
• Free computing power. Your hosting can be used to attack other sites, mine cryptocurrency, or host fake bank login pages.

It’s happening in every market

Country	What the latest official figures say
United States	A record US$20.9 billion in reported losses and 1,008,597 complaints to the FBI in 2025, a 26% jump in losses.4
United Kingdom	43% of all businesses found a breach or attack in the last 12 months. For small firms it was 46%, and for micro firms 42%.5
Australia	A cybercrime report every 6 minutes. The average small business report cost A$56,600, up 14%.6
Canada	About 1 in 7 small businesses (15%) were hit by a cyber security incident in 2025.7
New Zealand	Online threats cost New Zealanders an estimated NZ$1.6 billion in 2024.8

These surveys only count attacks people noticed and reported. Many website hacks are built not to be noticed, so the real numbers are higher.

Why small sites are often easier to get into

Big companies have security teams. Most small business sites were built once, by someone who has since moved on, and nobody has logged in for months. Old plugins, an admin account for a designer who left in 2021, a password used on five other sites: these are the doors robots try first.

That’s the uncomfortable truth behind the numbers. Being small doesn’t make you invisible. It makes you less likely to notice.

What actually helps

The good news is that the robots are lazy. They look for known, easy ways in. Close those and they move on to the next site on the list.

1. Find your doors. Know every place with a login: domain, hosting, website, email, Google Business Profile.
2. Lock the important ones. Two-step login on email, domain and hosting cuts the risk of account takeover by over 99%, according to Microsoft research.⁹
3. Remove the doors you don’t need. Every plugin, theme and login page is something to attack. Fewer moving parts beats more locks.

Our easy safety checklist walks you through it, and the free quiz tells you where your own site stands.

Sources

1. Wordfence, Quarterly WordPress Threat Intelligence Report, Q2 2026. ↩

2. Patchstack, State of WordPress Security in 2026 (2025 data): weighted median of five hours from disclosure to first mass exploitation for the most targeted flaws. ↩

3. Sucuri, SiteCheck 2024 Threat Report (published 2025). ↩

4. FBI Internet Crime Complaint Center, 2025 Internet Crime Report (April 2026). ↩

5. UK Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025/2026. ↩

6. Australian Signals Directorate, Annual Cyber Threat Report 2024–25, business factsheet. ↩

7. Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2025. ↩

8. National Cyber Security Centre NZ, Online threats cost New Zealanders $1.6 billion in 2024. ↩

9. Microsoft Research, How effective is multifactor authentication at deterring cyberattacks? ↩