WordPress security for small business comes down to a short, specific list of changes, not a vague sense that you “should probably look into security at some point.” WordPress now powers around 43% of all websites, which makes it the most targeted CMS on the internet, not because it’s weak, but because it’s everywhere. The twelve items below cover the changes that actually matter, in roughly the order they’ll have the most impact.
The single most effective defence in WordPress security for small business is also the most frequently neglected: keeping everything updated. Patchstack’s State of WordPress Security in 2026 report found that plugins accounted for 91% of all new WordPress vulnerabilities disclosed in 2025. Most of the list below exists to reduce exposure from exactly that source.
Set a weekly calendar reminder, every Monday, log in and update everything. Or use a maintenance plan for managed updates with staging tests before anything goes live, which removes the risk of an update breaking your site.
Admin passwords should be at least 20 characters, randomly generated, and stored in a password manager like 1Password or Bitwarden. Never reuse a password across sites.
The free version of WP 2FA covers this well for most sites. Require it for every admin and editor role. This alone defeats the overwhelming majority of brute-force login attacks, even if an attacker already has your password.
The default login at /wp-login.php is known to every bot scanning the internet. The free version of WPS Hide Login moves it to a custom URL, which dramatically cuts down brute-force attack volume on its own.
Wordfence’s free tier locks out an IP address after 3 to 5 failed login attempts. Combined with 2FA and a hidden login URL, brute-force attacks become essentially pointless to run against your site.
XML-RPC is an older WordPress feature used for remote publishing and pingbacks. It’s also a common target for brute-force attacks, since a single request to it can attempt many logins at once, bypassing standard lockout limits. Most sites don’t actively use it. Disable it with a free plugin like Disable XML-RPC, unless you specifically rely on the Jetpack mobile app or a similar integration that needs it.
Directories should be set to 755, files to 644, and wp-config.php to 440 or 400. Incorrect permissions are a frequent entry point for attackers who’ve gained even a small amount of server access.
Wordfence’s free tier includes a WAF that blocks known malicious requests before they reach WordPress. Cloudflare’s free plan adds another layer at the CDN level. Both should be active on every business site.
The free version of UpdraftPlus backs up your site daily and pushes it to Google Drive, Dropbox, or S3, off-site, so a server compromise doesn’t take your backups down with it. Test a restore every three months to confirm the backups actually work.
By default, WordPress exposes its version number in your page source and in readme.html. This tells an attacker exactly which known vulnerabilities to try. Most security plugins, including Wordfence’s free tier, include an option to hide this. Removing or blocking access to readme.html closes the other common way it leaks.
SSL must be active across the entire site, with every HTTP request redirecting to HTTPS, not just the homepage. Verify this properly at ssllabs.com/ssltest rather than just checking for the padlock icon in your browser.
Every inactive plugin is still a potential vulnerability sitting on your server. If you’re not using it, delete it, don’t just deactivate it. A lean plugin stack is a more secure plugin stack.
Items 1 through 5 cover the large majority of real-world attacks on small business WordPress sites. If you only have time to do five of the twelve right now, start there.
Don’t try to fix it on the live site. Put the site into maintenance mode, restore from the last clean backup on a staging copy, identify the entry point, patch it, then restore to production. Without a clean backup, professional malware removal is still possible, just more expensive and time-consuming. For the full step-by-step, see our guide on what to do if your WordPress site has been hacked.
No. Items 1 through 5 (updates, strong passwords, 2FA, hidden login, limited attempts) cover the bulk of real risk and are worth tackling first. The remaining items close smaller gaps and can follow over the next few weeks.
For most small business sites, the free tiers of Wordfence, WPS Hide Login, WP 2FA, and UpdraftPlus cover everything in this list adequately. Premium versions add convenience features, faster support, and more granular controls, but they’re not required to implement the core protections here.
For most sites, no. It only causes issues if you actively use the Jetpack mobile app, certain remote publishing tools, or specific third-party integrations that rely on it. If you’re unsure, check before disabling rather than assuming it’s safe.
The update step needs to happen weekly. The rest are mostly set-and-monitor: confirm backups are restoring correctly every three months, and review the full list roughly twice a year to catch anything that’s slipped.
A proper WordPress care plan covers all twelve of these as a matter of course, with staging tests before any update goes live. Book a free call if you’d rather have it managed than maintained manually.
Related: My WordPress Site Has Been Hacked: What to Do Right Now · What Should a WordPress Maintenance Plan Include?
Built to perform and maintained to last. Specialist WordPress studio for service businesses.