WordPress Security for Small Business: A 2026 Ontario Checklist

WordPress security for small business: you are not too small to be a target

WordPress security for a small business matters more than most owners think. It is tempting to assume that hackers only go after big companies, but the opposite is closer to the truth. In Verizon's 2025 Data Breach Investigations Report, ransomware or extortion appeared in 88% of breaches at small and medium businesses, versus 39% at larger organizations (Verizon 2025 DBIR). Smaller firms are attractive precisely because they often have weaker defences and less time to watch over them.

Most attacks on small-business websites are not personal, and they are not hand-picked. They are automated. Software constantly crawls the web looking for any site running a known weakness, and a corner-store website in Hamilton is just as visible to that software as a national brand. The good news: most of what protects you is straightforward, and you do not need to be technical to get most of it right.

Why WordPress sites get attacked (and where the risk really sits)

WordPress runs a huge share of the web, which makes it a favourite target. But the core software itself is rarely the weak point. Plugins account for roughly 96% of WordPress vulnerabilities; only a handful are ever found in WordPress core itself (Patchstack). The plugins and themes you add to extend your site are where the real exposure lives.

The volume is not slowing down either. Patchstack recorded nearly 8,000 new WordPress vulnerabilities in 2024, about a 34% increase on the year before (Patchstack, via SecurityWeek). That means a plugin that was perfectly safe last year can become a live risk this year, simply because someone discovered a flaw in it. Staying secure is less about a one-time fix and more about a few habits you keep up.

The 2026 WordPress security small business checklist

Work through these in order. None of them require code, and most take minutes. WordPress publishes its own guidance along the same lines (WordPress.org Hardening WordPress).

• Update everything, on a schedule. Keep WordPress core, every plugin, and your theme current. Pick a day each week to log in and apply updates so it never piles up.
• Delete what you do not use. Deactivated plugins and old themes can still be attacked. If you are not using it, remove it entirely, do not just switch it off.
• Turn on two-factor authentication (2FA). A password alone is no longer enough. 2FA means a stolen password is useless without the code on your phone.
• Use strong, unique passwords and a password manager. Never reuse the password from your email or bank on your website admin account.
• Limit who has admin access. Give each person the lowest role that lets them do their job. Remove logins for anyone who has left.
• Run regular, off-site backups. Make sure backups are stored somewhere separate from the site itself, and test that you can actually restore one.
• Use HTTPS everywhere. Your site should load with the padlock and a valid TLS certificate, with no mixed-content warnings.
• Set up email authentication (SPF, DKIM, DMARC). These records stop scammers from sending email that looks like it came from your domain.
• Add a reputable security plugin or firewall. A login-protection and firewall layer blocks a large share of automated attacks before they reach you.
• Remove file and version clutter. Old backup files, exposed configuration files, and visible version numbers all give attackers a head start.

The blind spot most checklists miss

Here is the catch. Almost every free website scanner only sees your site from the outside, the way a visitor (or an attacker) on the public internet does. That outside view catches real problems: a weak TLS certificate, missing email authentication, missing security headers, exposed files, and known weaknesses in versions it can detect from the street.

But it cannot see inside your WordPress admin. It cannot tell you the exact version of every plugin you run, whether any of them have a known vulnerability today, whether 2FA is actually switched on, or whether your files have been quietly tampered with. Since plugins are where most of the risk lives, an outside-only check leaves the most important part of your checklist unverified.

How BadgerScan checks the inside and the outside, together

BadgerScan starts with a free external scan: DNS, email security (SPF, DKIM, DMARC), your TLS certificate, HTTP security headers, exposed files, and known CVEs for versions that are publicly detectable. It is passive and safe, and you can run it right now with just your web address.

For WordPress sites, Pro (C$10 per month per site) adds a read-only plugin that scans the inside: the exact version of every plugin, theme, and the core, the CVEs that apply to them, your admin configuration, whether 2FA is on, and file integrity. It then fuses the inside and outside into one plain-English letter grade and one combined, deduplicated fix-list, so you are not juggling two separate reports. The plugin is read-only by design: BadgerScan never performs penetration testing or active exploitation.

If you would rather not work the list yourself, our local Canadian team can. Our managed cybersecurity service keeps the whole checklist maintained for you month to month, and a dedicated BadgerScan Analyst Review, a human writing your fix plan in priority order, is opening soon: join the waitlist on the plans page.

When to bring in a local Canadian team

A confident owner can run this checklist alone. But if the report turns up CVEs you do not understand, if your site has already been defaced or is sending spam, or if you simply do not have the hours, that is the point to hand it off.

CyberBadger is an owner-operated IT, cybersecurity, and web-design firm based in Hamilton and Burlington. We work on-site within about 40km and remotely across Canada. We can fix what the scan finds, rebuild a site that was hardened as an afterthought, and keep it watched so the next new vulnerability does not become your next bad week.