Do I need website security if my site is small?

By Graeme Preston, Founder & Owner · Published

"Who would bother hacking my little website?" is one of the most common things we hear. The honest answer is: nobody, personally. But automated tools scan the whole internet around the clock for websites with known weaknesses, and they don't care how small yours is. This guide explains the real risks, what you can do for free, and when paid website security is worth it.

How small websites get hacked

Almost never through a targeted attack. Small sites are broken into through:

  • an out-of-date plugin, theme or website software with a known weakness;
  • a weak or reused password; or
  • an old admin account that belonged to someone who left years ago.

Once in, attackers rarely deface the site, because that gets noticed. Instead they quietly add spam pages, redirect some visitors to scams, or use your site to send spam. The first you hear of it may be a Google warning next to your site in search results, or customers telling you your site looks odd.

What you can do for free

  • Keep everything updated: your website software, plugins and themes. This one habit prevents most hacks.
  • Delete plugins and themes you don't use; a deactivated plugin can still be exploited.
  • Use strong, unique passwords and turn on two-factor sign-in wherever your website offers it.
  • Remove old admin users.
  • Keep backups. We back up every hosting plan daily, and you can make your own backup before any big change (see Backups and restore).

A small site that does all of this is at low risk. The trouble is that "keep everything updated" is easy to let slip, and a hack can go unnoticed for weeks.

What Website Security adds

Website Security watches your site for you, and on the bigger plans fixes problems as well:

  • Find scans your site from the outside every day for malware, checks it isn't on a blacklist, and tells you if something's wrong. It doesn't fix anything, but it means you hear about a problem in a day rather than a month.
  • Fix also scans your website's files every day and removes malware automatically, plus daily checks for common weaknesses. This is the plan that saves you the clean-up.
  • Defend adds a firewall that blocks attacks and bad bots before they reach your site, and can make it load faster.

Every plan includes a Trust Seal you can show on your site.

Is it worth it for you?

  • Probably not essential for a simple site with few or no plugins that you keep updated yourself.
  • Worth considering if you run WordPress with several plugins, if nobody is really in charge of updates, or if your site takes enquiries or bookings you'd lose if it went down.
  • Strongly worth it for online shops and any site handling customer details, where a hack costs money and trust.

If you're going to buy one plan, Fix is usually the sweet spot for a small business: it finds and removes problems without you having to do anything.

Hacked right now?

Don't wait. Read What to do if your website has been hacked, change your passwords first, and consider Emergency Response: a one-off professional clean-up that starts within 30 minutes, with a week of monitoring afterwards. If your site is hosted with us, tell us straight away as well.

If you decide to add it

If your website is hosted with us, add Website Security to your hosting plan, so the file scanning and clean-up are set up for you; otherwise you'll need to enter your website's FTP details yourself. See Adding a product to your hosting plan. Our Website Security page shows the plans and current prices.