Security advisorywp2shell: WordPress core vulnerability. Updated August 4, 2026.
Read the advisoryWordPress security tips for small businesses: hosting, SSL, passwords, updates, plugins, backups, and simple habits that protect customers and revenue.
Topics Hardening & checklists Beginner guides
Updated Published
Small businesses get hit by the same bots as everyone else. You do not need an enterprise security team. You need a short list you can keep up with.
WordPress core is generally solid when updated. Most problems come from plugins, themes, weak logins, and neglected updates. Start there.
Do not run the site as a user named admin. Create a proper administrator account with a unique username, reassign content if needed, then remove the default account.
Managed WordPress hosting is often worth it for SMBs because patching, backups, and support are less DIY. Check uptime history, restore process, and whether support helps with malware events.
SSL/TLS is baseline now: customer trust, browser warnings, and SEO. Most hosts offer Let’s Encrypt or similar. Force HTTPS site-wide.
Unique passwords for every admin. Password manager. 2FA for anyone who can install plugins. Remove access the day someone leaves.
Core, plugins, themes, PHP. Schedule a monthly update window if you cannot do it weekly. Delaying known security updates is expensive thrift.
You want vulnerability checks, security tests, login protection, and preferably firewall + malware scanning. We build Security Ninja for that. Free covers a solid baseline; Pro adds the heavier protection.
Automatic backups, off-site copies, retention long enough to restore from before an infection. Test a restore once. See backup plan.
Disable pingbacks/trackbacks if you do not use them. Close open registration if the site does not need it. Fewer public endpoints, less noise.
Inventory quarterly. If it is not earning its place, delete it. Leftovers are a common weak spot.
Weekly or monthly:
If the site is already compromised, hire cleanup or a review. Prevention is cheaper than recovery, but recovery still beats hoping it goes away.
Found this useful? Share it.