Keeping a WordPress site online: hacks, backups and the boring work
Nobody targets a hardware shop in Ndeeba by name. The attacks are automatic, they scan everything, and they find whatever was left unlocked.
The short answer
Updates, few plugins, strong passwords with two-step login, and backups stored off the server. That routine prevents almost every hack that happens to small business sites.
How it really happens
People imagine a person choosing their site. That is not what happens. Programs scan the whole internet looking for known weaknesses, and when they find one they use it. Your site being small is not protection. It is just another address on the list.
Three ways in cover nearly everything. An old plugin or theme with a known hole. A pirated premium plugin or theme, which very often ships with a back door on purpose. And a weak password on an account called admin.
Notice what is not on that list: WordPress itself, kept updated, is rarely the way in.
What a hacked site looks like
Sometimes it is obvious. The home page is replaced, or the browser warns visitors before they reach you.
More often it is quiet and profitable for somebody else. Your site starts showing pages you never made, usually selling pills or gambling, hidden from you but visible to Google. Visitors from Google get redirected somewhere else while you, logged in, see nothing wrong. Or your server starts sending spam, and suddenly your business email is refused everywhere.
The first sign is often an email from Search Console saying pages were detected that you did not create, or a customer saying the site sent them somewhere strange. Believe the customer, and check with your phone using mobile data rather than your own computer.
If it happens, in order
Take a backup of the hacked site before you change anything. It is evidence, and sometimes the only copy of content you have not saved elsewhere.
Change every password: WordPress admin, hosting, database, FTP, and the email address linked to them. Then log out all sessions. If you skip this, they come straight back in.
Restore from a clean backup from before the hack if you have one. It is faster and safer than cleaning. If you do not have one, this is where a security plugin or a professional clean-up comes in, because the files they leave behind are designed to be missed.
Then update everything, delete every plugin and theme you are not using, and ask Google to review the site in Search Console if it was flagged. Finally, work out how they got in. If you skip that step, you will be doing this again in a month.
The routine that prevents it
Update WordPress, plugins and themes regularly. Once a month is a reasonable minimum for a small site, and security updates should not wait.
Use fewer plugins. Every one is another door. Delete what you do not use rather than leaving it deactivated.
Use real passwords and switch on two-step login for admin accounts. Do not use "admin" as a username. Give staff their own accounts at the level they need, and remove accounts when people leave.
Back up weekly, keep the copy somewhere other than the server, and test a restore once a year. Never install a pirated premium plugin or theme. The licence you saved is the cheapest way there is to get hacked.
Who does this work
Someone has to own it. For most small businesses the honest options are: learn to do it yourself in half an hour a month, pay a small monthly amount for someone to do it, or accept the risk and keep good backups.
What does not work is assuming the person who built the site is quietly maintaining it. Unless you are paying for that, they are not, and they should have told you so.
If you are paying for care, ask what it actually includes: updates, backups, uptime checks, a clean-up if something gets in, and how quickly they respond. Those are the parts that matter, not the plugin count in the report.
Questions people ask
Do I need a security plugin?
One is useful, more is not. A single reputable plugin for login protection, file scanning and alerts is enough. Two security plugins running together often conflict and slow the site down. The routine above prevents far more than any plugin does: updates, few plugins, strong passwords, and off-site backups.
How much does it cost to clean a hacked site?
If you have a clean backup, close to nothing but time. Without one, a professional clean-up is usually a few hundred thousand shillings depending on how deep it went and whether Google blacklisted you. There is a second cost people forget: the days of enquiries lost while the site is down or flagged. That is normally the bigger number.
Is WordPress less safe than a builder like Wix?
A hosted builder handles security for you, and for a site nobody maintains that is a genuine advantage. WordPress hands you the controls, which means it is as safe as the person looking after it. A maintained WordPress site is not meaningfully riskier. An abandoned one is. Choose based on who will be doing the maintenance.
My host says they secure everything. Is that enough?
Hosts secure the server. They do not update your plugins, choose your passwords, or decide which pirated theme somebody installed. Those are the ways sites get hacked. Server security matters and it is not the same as site security, so treat their protection as the floor, not the whole building.
Read next
What hosting actually buys you
Hosting is the running cost of a website, and it is where most of the bad surprises come from.
Read moreBefore you pay the final instalment
The last payment is the only leverage you will ever have. Spend an hour before you send it.
Read moreWhat your trade needs
We have written a page for every kind of business we build for, with what each one needs on a website.
See the tradesWant to talk it through before you decide anything?
Send one WhatsApp message saying what your business does. We will tell you honestly whether a website would help you, what it would cost and how long it would take. No charge for the conversation.