My website got hacked, or I'm worried it will: how to secure a small business website
⏱ In about 8 minutes
Affiliate disclosure: Some links on this page may become affiliate links. If you buy, we may earn a commission at no extra cost to you. Commissions may influence which products we choose to cover, but not our assessment of them. Read the full disclosure.
In this article
The short answer
Short answer
Common ways into a small business website are out-of-date software, weak or reused admin passwords, and untrusted plugins. So: keep everything updated, put two-step verification on every admin login, delete what you don't use, keep backups you've tested, and use hosting that takes security seriously.
Already hacked? Don't panic and don't just delete the bad pages. Jump to what to do if your site is hacked.
No website is "unhackable." These steps make yours a much harder target.
Why it matters
- Out-of-date software is a common way in. WordPress.org says old versions are "more open to attack, and is one of the primary reasons you should always keep WordPress up to date." (WordPress.org)
- Your admin login is the master key. WordPress.org warns that someone who "gains access to your administrator account is able to install malicious scripts that can potentially compromise your entire server." (WordPress.org)
- Google will warn your visitors. Pages affected by a security issue "can appear with a warning label in search results or an interstitial warning page in the browser." (Google Search Console Help)
Fix it: step by step
Step 1: Turn on automatic updates (15 minutes)
business.gov.au: "If your website is self-hosted, you'll need to keep your CMS and other tools up-to-date by applying the latest security patches. Turn on automatic updates or set up reminders to regularly update your applications." If you use a cloud-based builder, "the provider should keep your website safe from cyber attacks." (business.gov.au)
Step 2: Lock down every admin login (20 minutes)
"Whatever CMS you're using, choose a strong password and turn on two-factor authentication." (business.gov.au) Do the same for your hosting account and domain registrar. These are just as important. See our 2FA guide.
Step 3: Give everyone their own login, with the least access needed (15 minutes)
No shared "admin" account. Your web designer, copywriter and staff each get their own login, at the lowest role that works. Remove people who no longer need access. The ACSC advises following "the principle of least privilege." (ACSC)
Step 4: Delete unused plugins and themes (20 minutes)
Every plugin is code someone could exploit. WordPress.org: "Do not get plugins/themes from untrusted sources." (WordPress.org)
Step 5: Make sure backups exist, and that you can restore them (30 minutes)
WordPress.org says "having a plan to backup and recover your installation in the case of catastrophe can help you get back online faster." (WordPress.org) Check your host's backup schedule, and do one test restore to a staging site.
Step 6: Use HTTPS everywhere (10 minutes)
Most hosts include free SSL certificates. Make sure your whole site loads on https://.
Step 7: Choose hosting that helps (when renewing)
WordPress.org suggests a trusted host "readily discusses your security concerns," "provides the most recent stable versions of all server software" and "provides reliable methods for backup and recovery." (WordPress.org)
Step 8: Set up Search Console so Google can warn you (15 minutes)
Search Console sends "email alerts when Google identifies issues on your site." (Google Search Console)
What to do if your site is hacked
- Don't panic-delete. Take a copy of the hacked site first. Google's guidance even suggests making backups of an infected site, labelled "infected", if you have no clean backup. (web.dev)
- Call your host. Many managed hosts help with clean-up; some include malware removal.
- Restore a clean backup, then patch. Google's steps: "Restore your backup," then install updates, remove unused software, "correct the vulnerability," and "change the passwords one more time for all accounts related to the site (for example, logins for FTP access, database access, system administrators, and CMS accounts)." (web.dev)
- Fix every affected page. "Fixing the issue on just some pages will not earn you a partial return to search results." (Google)
- Request a review in Search Console. Once the site is clean, request a review in the Security Issues report. If Google finds your site clean, "warnings from browsers and search results will be removed within 72 hours." (web.dev)
- Report it. In Australia, report cybercrime to the ACSC via ReportCyber. If customer personal information may have been exposed, check your privacy obligations and get advice.
- Check your email and accounts too. If the attacker had your admin password, change any account that shared it. See what to do if you clicked a phishing link.
Quick pick
Quick pick: hosting with security built in (product details from official vendor pages, checked 18 Oct 2026. Not hands-on tested or security-tested. No ratings. Prices in US$, excluding taxes; confirm on the vendor's site.)
Most hands-off: Kinsta. Managed firewall (WAF) with DDoS protection, free malware removal, automatic daily backups, from US$30/month. → See our websites and SEO guide
More control: Cloudways. Server-level firewall, free SSL, a WordPress vulnerability scanner and automated backups, from US$14/month; automated malware removal is a paid add-on (from US$4/app/month listed). → See our websites and SEO guide- For the admin passwords themselves: a business password manager. See our password manager comparison.
What we'd avoid: honest limits
Free: the Small Business Password & Access Checklist
A 1–2 page checklist that turns this article into a to-do list: which accounts to protect first, how to set up shared access, and what to do when someone joins or leaves.
You only get emails if you tick the consent box. Unsubscribe any time. See our privacy policy.
Frequently asked questions
How do I know if my website has been hacked?
Signs include strange pages in Google results for your site, redirects to spam, new admin users you didn't create, or a warning from Google or your host. Check the Security Issues report in Search Console.
Is a website builder safer than WordPress?
With a cloud-based builder, business.gov.au says "the provider should keep your website safe from cyber attacks." You still need a strong password and 2FA.
How often should I update?
Turn on automatic updates where you can, and check at least monthly.
How long until Google removes the warning?
After a successful review, Google says warnings are removed within 72 hours. Reviews themselves can take from about a day to several weeks, depending on the issue.
Related guides
- Websites, hosting & SEO: our hub
- I want to turn on two-factor authentication
- Basic cybersecurity checklist for small business
- I need a proper website but have no time to manage it
Sources
Government and official sources first. All links checked and loading on 18 Oct 2026.
- business.gov.au (Australian Government): Set up a business website
- Australian Cyber Security Centre: Restrict and monitor access · Report a cybercrime (ReportCyber)
- WordPress.org: Hardening WordPress
- Google: Security issues report (Search Console Help) · Clean and maintain your site (web.dev) · Request a review (web.dev) · Search Console
- Vendor pages (checked 18 Oct 2026): Kinsta pricing · Cloudways pricing
About our review process
We pick products from official information and say clearly when we haven't tested something hands-on. Commissions may influence which products we choose to cover, but not our assessment of them. See how we work.