The threats are automated and indiscriminate, and the defences are mostly hygiene: keep every dependency current, use managed hosting with backups you have actually tested, enforce two-factor on every admin account, and shrink your attack surface by deleting what you do not use.
Nobody targets your business specifically, and that is exactly the danger: bots target everything, constantly, and unpatched sites are inventory. The August 2026 framework security releases were a reminder that even modern stacks need update discipline, and abandoned plugins remain the classic way in on legacy ones.
The defensive posture for a small firm is unglamorous: current software, minimal surface, tested backups, protected accounts. It prevents the overwhelming majority of real-world incidents.
The quarterly half-hour
Update everything. Delete unused plugins, themes and admin accounts. Verify a backup restores, because an untested backup is a hope, not a plan. Check that two-factor covers hosting, domain, CMS and email admin.
Statically rendered sites earn a mention here: with no database or plugin runtime exposed, the attack surface shrinks to almost nothing, which is a security strategy in itself.