Website Maintenance and Security: What Actually Keeps a Site Safe
Security is not a plugin you install once. It is a short list of maintenance habits, done every month, that make your site boring to attack.
Website Maintenance Team
Website maintenance since 2010
Website security is a maintenance habit, not a product. Most small business sites get hacked through outdated plugins, reused passwords, and forgotten admin accounts, not clever attacks. Updating within days of a patch, keeping tested backups, running a firewall, and turning on two-factor authentication closes nearly every door attackers actually use.
Key takeaways
- Almost every small business hack starts with an automated scan that finds outdated software, not a person targeting you.
- Applying plugin, theme, and core updates within a few days of release prevents more breaches than every other task combined.
- A backup you have never restored is a hope, not a plan. Test one every quarter.
- A firewall, two-factor authentication, and login limits stop the password-guessing bots that hit every login page around the clock.
- Hack cleanup runs $200 to $1,000 or more, and the Google warning, lost sales, and blocked email usually cost more than the cleanup.
- The free tiers of Cloudflare, Wordfence, and UpdraftPlus cover most of the basics if someone actually checks them monthly.
Most hacked small business websites were never targeted. Nobody sat down and picked them. A bot scanned a few million domains looking for one plugin with one known hole, found a site that had not been updated since spring, and walked in. That is the uncomfortable truth behind website maintenance and security: they are not two line items. Security is what you get when maintenance happens on time, and a breach is usually what you get when it does not. Here is how sites actually get compromised, the routine tasks that close each door, and what it costs when those doors stay open.
How small business websites actually get hacked
Forget the image of someone studying your business and planning a break-in. Nearly every small business compromise starts with automated scanning. Scripts crawl the web looking for a specific version of a specific plugin, a login page with no rate limit, or an account still named admin. When they find one, the exploit runs itself. Your site is not chosen. It is found.
The entry points are boring, which is exactly why they keep working.
- Outdated plugins and themes. When a developer patches a security hole, the fix goes public the same day, and so does the hole. Every site that has not updated is now running a documented, exploitable flaw. Attackers work straight from that list.
- Weak or reused passwords. If your admin password also unlocked a forum that leaked years ago, it is sitting in a list somewhere. Bots try those lists against WordPress login pages all day, every day.
- Abandoned admin accounts. The developer who built the site, the intern who posted blogs one summer, the agency you left. Each account that still exists is a door with a key you do not control.
- Nulled plugins and themes. Pirated copies of paid plugins are handed out free precisely because someone slipped a backdoor into the code. Installing one saves the attacker the trouble of breaking in.
- No firewall. Without a web application firewall in front of the site, every malicious request reaches your server and every password guess gets a fair try.
- Cheap shared hosting. On shared servers with poor isolation, another customer's hacked site can become your problem without you doing anything wrong.
It is almost never WordPress itself
Patchstack's annual WordPress security reports consistently attribute more than 90% of newly disclosed vulnerabilities to plugins, with themes a distant second and core a rounding error. The software you added is the risk, and updating it is the fix.
Source: Patchstack State of WordPress Security reports
The maintenance tasks that close each door
Every entry point above has a matching habit. None of them are exotic or expensive. The hard part is doing them every month, on schedule, when nothing seems wrong and there are twenty more urgent things on your desk.
- Updates within days, not months. Core, plugins, and themes. A weekly update window catches most patches quickly. A critical flaw in a widely used plugin deserves same-day attention. If the site sells anything, test on a staging copy first so an update cannot take the checkout down.
- Backups you have actually restored. Keep daily copies stored somewhere other than your web server, retain at least 30 days, and do a trial restore once a quarter. You want to learn that the process works on a quiet Tuesday, not at midnight after a breach.
- Malware scanning. A scanner compares your files against known-good versions and flags anything injected. Run it daily. Have a human look at the results weekly.
- A web application firewall. Cloudflare at the DNS level, or Wordfence and Sucuri at the application level. All of them block known attack patterns before those requests ever reach your code.
- Two-factor authentication. Turn it on for every account that can log in. A leaked password becomes useless without the second code from a phone.
- Login limits. Cap failed attempts, block the offending address for a while, and delete any user literally named admin. This alone kills most brute-force traffic.
- Remove what you do not use. A deactivated plugin is still code on your server, and it still gets scanned for holes. If you turned it off six months ago, delete it. Same for unused themes.
- SSL and security headers. A certificate that renews itself, plus headers like HSTS, X-Frame-Options, and X-Content-Type-Options. Many small business sites are missing several of them. Our free website checkup tests SSL and security headers and shows you which ones are absent.
If you only do one thing, do updates
Updates close more doors than every other item on that list combined. If keeping up with them is the part that keeps slipping, that is precisely the job a WordPress maintenance plan exists to take off your plate.
What a hacked website costs a small business
The bill arrives in pieces, and the cleanup invoice is usually the smallest piece. Owners tend to budget for the fix and get blindsided by everything around it.
Cleanup itself runs about $200 to $500 from a service like Sucuri or a maintenance provider, and $1,000 or more if a developer has to untangle a site that was reinfected three times because the backdoor never got found. That part is predictable. The rest is not.
- The Google warning. Once Safe Browsing flags the site, Chrome shows a full-screen red page and search results carry a warning label. Traffic drops to nearly nothing. After cleanup you request a review in Search Console, and that review can take days.
- Lost sales and leads. Every day the site is down or flagged is a day your contact form and phone go quiet. For a business that books online, that is the real loss.
- Email deliverability. A compromised server gets used to send spam. Your domain lands on blocklists, and suddenly your quotes and invoices go to customers' spam folders for weeks after the site is clean.
- Lingering search damage. Pharmacy and gambling spam pages injected into your site can stay in Google's index for months, showing up under your business name.
A site that is patched, backed up, and behind a firewall is boring to attack. Boring is the whole goal.
A monthly website security maintenance checklist
This is the routine, stripped to what matters. Print it, put it in a calendar, or hand it to whoever maintains the site and ask them to confirm each line every month. If you want the longer view of what neglect looks like over a year, read what happens if you do not maintain your website.
| Task | How often | What it protects against |
|---|---|---|
| Update core, plugins, and themes | Weekly, same day for critical patches | Known exploits in outdated code |
| Confirm backups ran, test a restore | Daily check, quarterly restore test | Botched updates, ransomware, deleted files |
| Review malware scan results | Weekly | Injected code, backdoors, SEO spam |
| Audit users and remove stale accounts | Monthly | Ex-contractor access, forgotten admin logins |
| Check SSL expiry and security headers | Monthly | Browser warnings, clickjacking, downgrade attacks |
| Delete unused plugins and themes | Monthly | Dormant vulnerable code nobody is watching |
Security tools worth knowing: Wordfence, Sucuri, Cloudflare, UpdraftPlus
You do not need all of these, and you do not need the paid tier of most of them. A sensible stack for a small business site is Cloudflare in front, one security plugin on the site, and one backup plugin sending copies somewhere off the server. Here is the honest version of each.
| Tool | Free tier | Paid tier | Honest note |
|---|---|---|---|
| Wordfence | Scanner, login limits, firewall with new rules delayed 30 days | Premium adds real-time firewall rules and malware signatures | Runs on your server, so it adds load. The free tier is genuinely useful. |
| Sucuri | WordPress plugin for scanning and hardening | Roughly $200 to $500 a year for the cloud firewall and cleanup | The cleanup guarantee is the real product. Buy it for that, not the scanner. |
| Cloudflare | DNS, CDN, free SSL, basic DDoS protection | Pro at about $20 a month adds the managed firewall rules | Best value on this list. The paid firewall is worth it for stores. |
| UpdraftPlus | Scheduled backups to Google Drive, Dropbox, or S3 | Premium near $70 a year adds incremental backups and migration | Free version is enough for most sites, if someone confirms it actually ran. |
A tool you never look at is not protecting you
The most common thing we find on a hacked site is a security plugin that was installed two years ago, sending warnings to an inbox nobody checks. Tools flag problems. A person still has to act on them. Budget the twenty minutes a month, or pay someone whose job it is.
How much of this should your hosting handle?
More than you might think. Good managed hosting gives you automatic SSL renewal, daily backups that are stored off the server, server-level firewall rules, and isolation from other customers. That quietly takes three or four rows off the checklist above. Providers like WP Engine and Kinsta build this in, and our own managed website hosting includes free SSL, daily backups, and 99.9% uptime as standard.
What hosting cannot do is update your plugins, remove your ex-developer's login, or decide whether the update that shipped this morning is safe to apply to a site with a live checkout. That layer is either you, or a maintenance plan.
Should you handle website security maintenance yourself?
You can. Plenty of owners do, and for a brochure site with no store the free tools above and the checklist are enough. The question that matters is whether you will still be doing it in month nine, when the site has been fine for so long that skipping a week feels harmless. Skipping is how every hack we have cleaned up got started.
If the site brings in customers, the math usually favors handing it off. Maintenance plans start at $99 a month, which is less than a single cleanup, and the plan is what keeps the cleanup from being needed in the first place. Whichever way you go, run the free checkup first so you know which doors are open today.
Find out which doors are open on your site
The free checkup tests your SSL, security headers, speed, and SEO and shows you exactly what to fix first, with the report emailed to you as a PDF you can keep.
Run the free website checkupFrequently asked questions
In practice, there is not much of one. Security is the outcome, and maintenance is the work that produces it. Updates, backups, user cleanup, and scanning are all maintenance tasks, and together they are also the majority of what keeps a small business site from being hacked. A security product without the maintenance routine behind it protects very little.
Check for updates weekly and apply them within a few days. For a critical vulnerability in a widely used plugin, apply the patch the same day, because attackers start scanning for unpatched sites within hours of disclosure. Sites with a store should update on a staging copy first, then push to live once checkout is confirmed working.
Yes, and it does not have to cost anything. Cloudflare's free plan puts a basic layer of protection in front of your site, and the free version of Wordfence blocks known attack patterns at the application level. A firewall stops most automated attacks before they reach your code, which is the difference between a scan and a breach.
For most small business sites, the free tier of Wordfence plus Cloudflare's free plan and two-factor authentication covers the basics well. Its firewall rules arrive 30 days late compared to the paid version, so sites that sell online or hold customer data should consider paying for real-time rules. What matters more is that someone actually reads the alerts it sends.
Common signs are a red warning page in Chrome, search results showing pharmacy or gambling text under your business name, unexpected redirects to other sites, new admin users you did not create, a sudden drop in traffic, and your own emails landing in spam. A malware scanner will confirm it, and Google Search Console lists security issues it has detected.
SSL encrypts traffic between the visitor and your site, which protects passwords and form entries in transit. It does nothing about an outdated plugin, a weak admin password, or a backdoor already on the server. Treat the padlock as one required item on the checklist, not as proof the site is safe.
Sources
- Patchstack State of WordPress Security reports
- Sucuri Hacked Website Threat Reports
- Google Search Console documentation on security issues and Safe Browsing
- OWASP guidance on HTTP security headers
Website Maintenance Team
Website maintenance since 2010
We have cleaned up more hacked small business sites than we would like, and nearly every one traced back to a maintenance task that was skipped for months. This is the list we wish those owners had.