Myth 1: “We’re too small to be a target”
This is the big one. Attacks on websites are mostly automated: software crawls the internet looking for any site with a known weakness, and it has no idea whether you’re a corner shop or a household name. If your site has an unpatched hole, it gets found. Being small doesn’t make you invisible, it just means you’re less likely to have anyone watching.
Myth 2: “My hosting company takes care of everything”
Your host looks after the server your site sits on. Your WordPress software, your plugins and your theme are usually your responsibility, unless you’ve specifically agreed otherwise. The same goes for backups: some hosts include them, some charge extra, and some keep them for only a few days. It’s worth asking your host, in writing, exactly what’s covered.
Myth 3: “If it isn’t broken, don’t touch it”
It’s a sensible rule for a kettle, but not for a website. Updates are mostly security fixes, and once a fix is published, everyone (including the bad guys) can see what was wrong. WordPress itself released two security and maintenance updates within a week in September (version 7.1.1 on 17 September, then 7.1.2 on 22 September). Sites that wait are leaving a known door unlocked.
Myth 4: “The more security plugins, the safer we are”
Piling on security tools can actually backfire. They can overlap, slow your site down, and each one is another thing that needs updating. One well-chosen, well-maintained security tool, plus regular updates and tested backups, beats a stack of half-configured extras every time.
Myth 5: “I’d know if my site had been hacked”
Sadly, not necessarily. Modern attacks are often quiet. Hackers might add spam pages that only Google can see, redirect visitors from search results to dodgy sites, or just sit there waiting. Your homepage can look perfectly normal for weeks. By the time customers tell you something’s wrong, the damage to your reputation (and your search ranking) is often done.
The common thread is that website security is rarely dramatic. It’s a bit like servicing a van: skipping it feels free until the day something fails, usually at the worst possible moment. A small, regular routine costs far less than a clean-up after a hack, and far less than the sales you lose while your site is offline or flagged as unsafe by browsers.
Your ten-minute website health check
Try this today. Log in and see whether any updates are waiting, for WordPress, plugins or your theme. Delete any plugins you no longer use. Find out when your last backup was taken and, ideally, whether anyone has ever tested restoring it. Finally, search Google for your business name and click through a few results to check nothing odd shows up. If any of that turns up surprises, or you simply don’t have the time, it’s worth getting someone to take it off your plate.
If keeping on top of updates, backups and security checks feels like one job too many, our WordPress Maintenance service takes care of it for you, so your site stays safe and you can get on with running your business. Find out more about WordPress Maintenance
