You do not need to be hacked to have a security problem: The hidden cost of an unprotected WordPress site

The most common response I hear from business owners when the subject of website security comes up is: "We have not been hacked, so we must be fine." I understand why that feels reassuring. But in my experience, it is exactly the wrong way to think about it.

Security problems do not always arrive with a warning. Often they are already present, quietly doing damage, weeks before anyone notices.

Below I will explain what that actually looks like, what it costs, and what a more honest assessment of your current position might reveal.

Hello, I’m Bogdan. WordPress has been my working environment for over 25 years. I won’t try to turn you into a technical expert.
My goal is simpler: to show how everyday website issues quietly cost businesses money. It’s often without hacks, drama, or obvious failures.
Missed updates, poor maintenance, or weak internal processes are usually enough.

What is happening (non-technical explanation)

A WordPress website is not a locked box that is either open or closed. It is more like a building with multiple entry points: the front door, the service entrance, the windows, and the infrastructure running behind the walls.

Most security incidents do not happen because someone forced the front door. They happen because a side entrance was left unattended. An outdated plugin with a known vulnerability. An admin account that was never removed when a staff member left. A password that has not been changed in three years.

The Patchstack State of WordPress Security Report 2025 recorded 7,966 new vulnerabilities in the WordPress ecosystem, primarily in third-party plugins. That is a 34% increase on the previous year. The majority will never be actively exploited. But 11.6% received a critical or high severity score, meaning they are either already being exploited or expected to be.

Here is what makes this particularly uncomfortable for business owners: according to the IBM Cost of a Data Breach Report 2025, it takes organisations an average of 204 days to identify a breach, and a further 73 days to contain it. That is the better part of a year during which a compromised site continues to operate, take enquiries and present itself as trustworthy, while something is quietly wrong.

For a small business without monitoring in place, that window does not shrink. It can grow considerably longer.

How this issue hurts your business

The damage from an undetected security problem is rarely dramatic. It is cumulative, quiet, and by the time it surfaces, it is expensive to reverse.

• Enquiries and leads lost or redirected without the business knowing
• Client data exposed, even in small amounts, triggering GDPR obligations and ICO reporting requirements
• SEO rankings damaged as search engines detect and flag suspicious behaviour on the site
• Reputation affected if a client or prospect encounters something unexpected on the site
• Recovery costs that are significantly higher the longer a compromise goes unaddressed
• Internal time consumed by investigation, remediation and follow-up communications

According to the UK Government Cyber Security Breaches Survey 2025, the average cost of the most disruptive breach for UK businesses was £3,550, excluding those who reported zero cost. For businesses where the breach involved stolen credentials or undetected access over an extended period, the cost is considerably higher.

Cost of inaction (what this really costs your business)

Real-life scenario:

A small manufacturing business uses its website primarily to showcase its product range, handle trade enquiries and direct new clients to a contact form. The site has not been reviewed for security in over a year. No monitoring is in place. Updates have been applied inconsistently.

An outdated plugin contains a known vulnerability. An attacker uses it to gain access and installs a hidden script that redirects a portion of incoming traffic and harvests contact form submissions.

The business notices nothing for three to four weeks. The site looks normal. Enquiries appear to be arriving, though slightly fewer than usual. It is only when a longstanding client mentions they tried to get in touch and heard nothing back that anyone starts investigating.

The impact over that period typically looks like this:

• Lost or intercepted enquiries: £2,000 to £5,000 in pipeline value
• Marketing spend running throughout: £400 to £900 wasted
• Security investigation and full site cleanup: £1,000 to £2,500
• ICO notification assessment and legal review if data was exposed: £500 to £1,500
• Internal management time spent coordinating the response: invisible, but real

Total cost for one incident: easily £3,500 to £9,500, with no visible outage, no ransom demand and no obvious warning sign. That is the real cost of inaction.

Warning signs you should not ignore

These are the signals I see most often in businesses that turn out to have an existing or developing security problem:

• WordPress and plugins have not been updated consistently for several months
• Admin user accounts include people who no longer work with the business
• No one can confirm when the site was last checked for unusual activity
• Enquiry volumes have dipped quietly with no obvious explanation
• The hosting provider has never been asked about security monitoring or malware scanning
• Two-factor authentication is not enabled on WordPress admin accounts

None of these individually confirm a problem. Together, they describe a site that is significantly more exposed than its owner realises.

Quick checks you can do today (5 to 10 minutes)

Here is where I would suggest starting, without needing any technical knowledge.

• Log in to WordPress and check the list of admin users. Remove anyone who should no longer have access
• Check when plugins and themes were last updated. If several are months behind, that is a risk worth addressing promptly
• Ask your hosting provider directly: is malware scanning in place, and when was it last run?
• Send a test enquiry through your contact form and confirm it arrives correctly
• Ask internally: does anyone have oversight of this site on a regular basis, or is it assumed to be fine?

If the honest answer to that last question is "not really", that is the most important thing to address first.

Fix options (from fastest to safest)

Immediate containment Audit and remove unused admin accounts. Apply any outstanding plugin and theme updates. Confirm that backups exist and are restorable.

Proper fix (root cause) Conduct a full security review: access controls, plugin audit, malware scan, login security and hosting environment. Do not assume the site is clean without checking.

Prevention Put monitoring in place so that changes to admin accounts, unusual login activity or site modifications trigger an alert immediately rather than going unnoticed for weeks or months.

The goal is not to make the site impenetrable. The goal is to make sure that if something happens, you find out the same day, not three months later.

How to prevent this from happening again

What I recommend to any business that relies on its website for leads, credibility or sales:

• Consistent updates on a scheduled basis, not as an occasional catch-up
• Regular audits of who has access and at what level
• Monitoring and alerts for admin activity, login attempts and site changes
• Hosting that includes malware scanning at the server level, not just via a plugin
• A clear owner for website security, someone who is accountable, not just assumed to be on top of it

Security is not a one-time task. It is an ongoing operational responsibility, like any other part of running a business.

Related issues to check next

• Phishing does not just steal passwords: it can take over your website and cost you clients
• Updates done wrong can break your site: updates skipped can break your business
• Hosting isn't a technical detail: it's uptime, speed, and whether customers trust your business
• Why websites fail during campaigns, not quiet periods

Key takeaways

• Most WordPress security problems go undetected for weeks or months before any visible sign appears
• In 2024, nearly 8,000 new vulnerabilities were identified in the WordPress ecosystem, a 34% increase on the previous year
• The average cost of a disruptive cyber breach for UK businesses was £3,550 in 2025, and considerably more when detection is delayed
• The absence of a visible incident is not confirmation that everything is fine
• Prevention and monitoring cost a fraction of what investigation and recovery cost after the fact

FAQ