The honest checklist for figuring out whether the site nobody's touched in two years is about to cost you a customer.
Most of the WordPress sites we audit in Austin fall into the same trap: somebody built it three years ago, it 'worked,' and nobody has logged in since. The plugins are stale, the admin password is shared, and the only backup lives on a former employee's laptop. If that sounds even a little familiar, your site is probably one bad day away from an incident — not because WordPress is bad, but because nobody is minding the store.
The 60-second self-assessment
Run through this list honestly. If you check three or more, you have a real risk to deal with — not someday, now.
- You can't remember the last time WordPress core was updated.
- There are more than 15 active plugins, and at least one looks abandoned in the dashboard.
- Admin logins use shared credentials or don't have two-factor enabled.
- There's no scheduled, off-site backup you've actually tested by restoring.
- The hosting plan is the cheapest tier from a discount provider you barely recognize.
- There's no web application firewall (WAF) in front of the site.
- Your contact form, login page, or wp-admin are reachable from every IP on the internet with no rate limiting.
What 'getting hacked' actually looks like
It is almost never a hooded figure typing fast. It's an automated script that finds an outdated plugin with a known CVE and injects a redirect so half your traffic ends up on a sketchy pharmacy site. By the time you notice, Google has flagged the domain and your sales calls are getting the 'this site may be unsafe' warning on the prospect's screen.
What 'secure enough' actually means for a small business
You do not need a SOC 2 program to run a safe WordPress site. You need a small number of controls, applied consistently:
- 1Managed hosting with daily off-site backups and one-click restore.
- 2WordPress core, themes, and plugins on an automatic minor-version update schedule, with monthly review of major versions.
- 3A WAF and brute-force protection in front of wp-login and xmlrpc.
- 4Two-factor auth on every admin account, no shared logins, and a quarterly user audit.
- 5Uptime and integrity monitoring so you find out before your customers do.
When to patch, when to replace
If your site is mostly a brochure with a contact form, patching is usually the right call. If it's running an old page builder, a forked theme, and a checkout plugin that's two major versions behind, you're often better off rebuilding on a modern stack than chasing a moving target. We help clients make that call honestly — including telling them when not to spend money with us.
If you checked three or more boxes above and you want a second opinion, we'll do a free read of your public surface area and tell you what we'd actually do. No upsell theater.
