Most business owners we talk to assume website security is either somebody else’s job or somebody else’s problem. A common version goes something like “we’re a filtration company in Burlington, why would anyone bother attacking us?”
It’s a reasonable instinct and it rests on a wrong model. Nobody chose you. Almost every website compromise begins with malicious software scanning the entire internet for a known weakness, finding it, and exploiting it automatically. Your company name never came into it.
This is a plain-language guide to what that actually means, written for people who run businesses rather than servers.
How sites really get compromised
The mental image most people have involves a person deciding to attack their company. The reality is closer to a machine reading a list.
When a vulnerability in a popular plugin is published, that disclosure is public by design, so site owners can patch. Automated scanners read the same announcement. Within hours they are scanning through the web looking for sites still running the vulnerable version.
The median gap between a WordPress vulnerability being disclosed and the first exploitation attempt is around five hours. Nothing about that process involves anyone caring who you are. A small Ontario manufacturer and a national retailer look identical to a scanner, because both are just an address running a version number.
That’s oddly reassuring, once it lands. You don’t need to be interesting to be attacked, but you also don’t need elaborate defences. You mostly need to not be the site running last year’s version.
How Sites Really Get Compromised
- 1A plugin vulnerability is published, so site owners can patch it.
- 2Automated scanners read the same public notice.
- 3They sweep the web looking for unpatched versions.
- 4Yours is found in hours rather than weeks.
- 5Nobody ever chose your company. You were just running the version they were looking for.
Where the risk actually lives
For a WordPress site, the risk is concentrated in one place, and it isn’t WordPress.
Patchstack’s 2026 security report counted 11,334 new vulnerabilities across the WordPress ecosystem during 2025. Roughly nine in ten were in plugins. Only a handful were in the WordPress core itself, and those were low risk and fixed quickly.
The average site runs twenty to thirty plugins. Every one is software with full access to your site, written by someone you have never met and maintained at their discretion. Most are excellent and well-coded. However, some were abandoned in 2019 and still sit in the directory.
Two details from that report are worth knowing, because they contradict advice you have probably heard.
- Paid plugins are not necessarily safer. Premium plugins receive less independent security scrutiny than free ones, not more, because researchers can’t easily see the code. Patchstack’s own research into premium marketplaces produced nearly two thousand valid vulnerability reports.
- Updating promptly isn’t always enough. Around 46% of the vulnerabilities disclosed in 2025 had no patch available on the day they became public. Updating is still the single most valuable thing you do. It just isn’t the whole job.
The basics that cover most of it
You don’t need an enterprise security programme. For a typical B2B marketing site, this list covers the overwhelming majority of real-world risk:
- Keep everything updated, on a schedule, tested on a staging copy before it hits the live site.
- Reduce your plugin count. The safest plugin is the one you removed because nothing was using it.
- Use strong, unique passwords and two-factor authentication on every admin account. Credential reuse is still one of the most common ways in.
- Remove old accounts. The developer who left in 2021 should not still have administrator access.
- Run HTTPS properly, with the certificate renewing automatically.
- Take backups that live somewhere else, and restore one occasionally to confirm it works. An untested backup is a guess.
- Keep PHP current. Running an unsupported version means you stop receiving security fixes for the language your site is written in.
- Choose hosting that takes it seriously. Testing in 2025 found hosting-level defences blocked a wide range of attacks, with some hosts stopping most and others stopping almost nothing.
Notice how much of that is ordinary website maintenance rather than security work as such. That’s not a coincidence. For most B2B companies, being reasonably secure and being reasonably maintained are the same activity described two ways.
The Security Basics
When core does have a problem
WordPress core is genuinely well defended, which makes the exceptions instructive.
In July 2026 a serious vulnerability in WordPress core was disclosed, affecting a range of recent versions. It was fixed within days, forced updates were pushed automatically, and the Canadian Centre for Cyber Security issued an advisory. That is the system working roughly as it should.
The uncomfortable part is what came next. Weeks after the fix, millions of sites were still running the older branch. The patch existed. Nobody had applied it.
Which brings the whole subject back to one question. Not “is my site secure?” but “is anyone actually looking after it?”
What to ask whoever manages your site
If a provider handles your site, four questions will tell you most of what you need to know:
- How quickly are security updates applied after release?
- Are updates tested somewhere before they reach the live site?
- Where are backups stored, and when was a restore last tested?
- If the site is compromised, is the cleanup included or billed separately?
If you can’t get straight answers, that’s an answer. It also tends to correlate with other ownership problems worth investigating while you’re asking.
If something does happen
Compromises are recoverable, and panic makes them worse. Get the site offline or into maintenance mode, tell your host, and restore from a backup taken before the compromise, which is the moment those untested backups either save you or don’t.
Then find how they got in, because restoring without patching the hole just resets the clock. Change every password afterwards, and if customer data may have been exposed, take advice on your obligations under Canadian privacy law rather than guessing.
You don’t need to be an expert
Website security for a small or mid-sized B2B company is not a specialist discipline. It’s a maintained site, a short list of habits, and someone paying attention.
The companies that get hurt are almost never the ones that made a sophisticated mistake. They’re the ones where nobody had logged in for a year, and the site was quietly running software with a hole in it that had been public since last spring.
If you’d like an outside read on how your site is currently protected, and who is actually watching it, book a discovery call and we’ll go through it together.
