Website Security Threats 2026: A UK Small Business Guide

Most attacks on small business websites aren't targeted. They're automated, cheap and aimed at whatever is easiest to break: an old plugin, a reused password, a staff member who clicks a convincing link. This guide sets out the biggest website security threats for UK small businesses in 2026, using the latest UK Government breach survey and NCSC data, and ends with a checklist you can work through in an afternoon.

How common are cyber attacks on UK small businesses?

The UK Government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026 (fieldwork August to December 2025), is the best picture we have. Its headline figures for businesses:

Among businesses and charities that had a breach, phishing was the most disruptive type for 69% of them. The previous survey (2025, fieldwork late 2024) told the same story: phishing affected 85% of businesses that identified a breach, followed by impersonation (34%) and malware (18%), with takeovers of website, social media or email accounts at 7%.

At the national level, the NCSC handled 204 "nationally significant" incidents in the 12 months to August 2025, up from 89 the year before. Those are mostly large organisations, but the tools and techniques filter down to everyone.

The takeaway: nearly half of UK businesses find a breach or attack every year, and the most common route in is a person, not a server.

Threat 1: Vulnerable plugins, themes and extensions

If your site runs WordPress, plugins are your biggest technical risk. Patchstack's State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% rise on 2024. 91% were in plugins and 9% in themes. WordPress core had only six, all low priority.

Two numbers from the same report matter even more for small businesses:

• 46% of vulnerabilities had no fix from the developer by the time they were publicly disclosed.
• For heavily targeted vulnerabilities, the weighted median time to first exploit was 5 hours, and about half of high-impact vulnerabilities were exploited within 24 hours.

Monthly updates are no longer fast enough for high-risk plugins. Turn on automatic updates for plugins you trust, remove anything you don't use (deactivated plugins can still be exploited if their files remain), and avoid plugins that haven't been updated in a year.

Hosted platforms like Shopify, Wix and Squarespace handle core patching for you, but third-party apps and embedded scripts still carry risk. Review installed apps twice a year and remove the ones you've stopped using.

Our WordPress security checklist goes into the hardening steps in detail.

Threat 2: Credential stuffing and weak admin logins

Credential stuffing is when attackers take usernames and passwords leaked from one breach and try them automatically on other sites. It works because people reuse passwords. Your website admin, hosting control panel, domain registrar and email accounts are all targets.

Defences that work:

1. Turn on two-factor authentication everywhere it's offered. Only 47% of businesses use any 2FA, according to the 2025/2026 survey. Start with email, domain registrar, hosting and website admin, in that order. Our guide to two-factor authentication for website admins covers WordPress, Shopify and cPanel.
2. Use a password manager and unique passwords. The NCSC recommends three random words for passwords you need to remember, and a password manager for the rest.
3. Limit login attempts. On WordPress, use a security plugin or your host's login protection. Cloudflare users can add a rate-limiting rule for /wp-login.php and /xmlrpc.php.
4. Remove old accounts. Former staff, agencies and freelancers should not still have admin access.

Threat 3: Phishing and business email compromise

Phishing is the most common attack by a wide margin. For small businesses, the expensive version is business email compromise (BEC): a criminal either takes over a real mailbox or spoofs your domain, then sends a convincing invoice or "change of bank details" email to a customer or supplier.

Your website and domain play a direct part in this:

• If your domain has no DMARC policy, criminals can send email that appears to come from it. Publish SPF, DKIM and DMARC, then move DMARC to enforcement. Our guide to stopping email spoofing of your domain walks through it.
• Contact forms are abused for phishing and spam. Add a CAPTCHA or honeypot, and don't let forms send an auto-reply that includes the visitor's message text.
• Agree a verbal check for payment changes. No technical control replaces a phone call to a known number before changing bank details.

AI tools have made phishing emails more fluent and easier to personalise, so spelling mistakes are no longer a reliable warning sign. Train staff to check the request, not the grammar.

Threat 4: Ransomware and destructive attacks

Ransomware hit about 1% of UK businesses in both of the last two government surveys. That sounds small, but the impact on those businesses is severe: lost data, days of downtime and sometimes the end of the business.

For websites, the equivalent threat is an attacker who deletes or encrypts your site and database, often after getting in through a vulnerable plugin or stolen hosting login. The defence is the same for both:

• Keep backups that the attacker can't reach. At least one copy should be off the server and not deletable from your hosting account. Test that you can restore it.
• Keep 30 days or more of history. Infections are often discovered weeks later.
• Know who to call. Write down your host's support route, your developer's number and where the backups live before you need them.

Our website backup guide explains the 3-2-1 rule for small sites.

Threat 5: Supply-chain scripts

Most websites load JavaScript from other companies: analytics, chat widgets, cookie banners, fonts, review badges, payment buttons. Each one runs with full access to your page. If that supplier is compromised, your visitors are too.

The best-known example is polyfill.io in June 2024. The domain behind a popular browser-compatibility script was bought by a new owner, and security researchers at Sansec reported it was injecting malicious code into more than 100,000 sites that still loaded it.

How to reduce the risk:

1. List every third-party script your site loads and remove what you no longer use. Our guide to third-party scripts shows how to find them.
2. Self-host static libraries where you can, rather than loading them from someone else's domain.
3. Use a Content-Security-Policy to restrict which domains can run scripts on your pages. Start in report-only mode. Our CSP generator builds a starting policy in the browser.
4. Use Subresource Integrity (SRI) for scripts that never change, so the browser refuses a modified file.
5. Ask suppliers about their security. The 2025/2026 survey found only 15% of businesses review the risks posed by their immediate suppliers.

Threat 6: Exposed files and misconfiguration

Not every incident needs a sophisticated attacker. Common, preventable exposures include:

• .env files with database passwords, and .git folders, left publicly readable. See our guide to exposed .env and .git files.
• Old backup files such as site-backup.zip in the web root.
• Staging sites with real customer data and no password.
• Missing security headers, which leave visitors more open to clickjacking and script injection.
• Expired or misconfigured SSL certificates.

Our free security headers checker (free account required) reports which headers your site sends, including HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, and gives copy-paste Nginx and Apache config for the ones that are missing. The full audit also checks for exposed .env and .git files and an X-Powered-By header that leaks your stack.

The 2026 website security checklist for UK small businesses

Work through this in order. The first five items prevent most of the incidents above.

The NCSC's free Cyber Action Toolkit is designed for sole traders and small organisations and gives tailored quick wins. Cyber Essentials is the next step: the NCSC notes that organisations with turnover under £20m that certify their whole organisation get automatic cyber liability insurance. Only 5% of businesses held Cyber Essentials in the 2025/2026 survey, so it still sets you apart when bidding for work. Our post on Cyber Essentials changes in 2026 covers the latest requirements.

For the full hardening list, read our guide on how to secure a small business website. To see where your site stands today, run a free website audit. It checks SSL, security headers, exposed files and email authentication in one scan.

Frequently asked questions

What is the most common cyber attack on UK small businesses?

Phishing. The UK Government's Cyber Security Breaches Survey 2025/2026 found 38% of businesses experienced phishing in the previous 12 months, and it was the most disruptive type of attack for 69% of those that had a breach.

Are small business websites really targeted by hackers?

Mostly not by name. The majority of attacks are automated scans for known vulnerabilities and reused passwords, so any site running an outdated plugin or weak login is at risk regardless of size.

How quickly do I need to apply WordPress plugin updates?

As quickly as you can for security fixes. Patchstack found that heavily targeted WordPress vulnerabilities had a weighted median time to first exploit of five hours in 2025, so automatic updates for trusted plugins are worth enabling.

Does using Shopify or Wix mean I don't need to worry about security?

They patch the platform for you, which removes a big category of risk. You still need 2FA on your account, care with third-party apps and scripts, and SPF, DKIM and DMARC on your domain.

Is Cyber Essentials worth it for a small business?

For most, yes. It covers the controls that stop the most common attacks, and organisations with turnover under £20m that certify their whole organisation get automatic cyber liability insurance, according to the NCSC.

Related reading

• WordPress 7.1.3 Security Release: What Site Owners Should Check: WordPress 7.1.3, released on 6 October 2026, fixes seven security issues including stored XSS and SQL injection. What site owners should check and update.

Sources

• UK Government: Cyber Security Breaches Survey 2025/2026 (30 April 2026)
• UK Government: Cyber Security Breaches Survey 2025 (10 April 2025)
• NCSC: UK experiencing four 'nationally significant' cyber attacks every week (14 October 2025)
• NCSC: Small businesses to receive cyber security boost with new toolkit from experts
• NCSC: Three random words
• Patchstack: State of WordPress Security in 2026
• The Record: Polyfill, Cloudflare trade barbs after reports of supply chain attack