When I ask a client whether their site is secure, the answer is almost always the same: “yes, it has the little padlock”. It comes with such confidence that I hate ruining the moment. I ruin it anyway, that is what they called me for. The padlock means one thing only: the pipe is encrypted. It says absolutely nothing about what travels through that pipe, or who holds a key to the house at the other end.
I am not knocking TLS. It solves a real problem: no intermediary reads or alters the communication. But the other problems, the ones that actually hit small businesses, do not live in the pipe. They live one level up, in the application itself. So let us look at what the people who count say.
What OWASP is telling us about 2025
The OWASP Top 10 is the most widely recognised list of risk categories for web applications, and the 2025 edition is the eighth in the series. It is not a list of scary names, it is a list of what genuinely goes wrong. The top three:
A01, Broken Access Control. Still first, like a singer holding the top spot for decades. In plain words: someone sees or does something they should not, because the application does not properly check who is asking for what.
A02, Security Misconfiguration. Moved up to second. Default passwords, open directory listings, error messages left on that reveal the internals of the house. That is not really a break-in. That is an open door!
A03, Software Supply Chain Failures. A new category, and the one most relevant to anyone running a site on a platform with plugins. They do not attack you, they attack something you installed. Small difference in wording, enormous one in consequence.
What ENISA measured across Europe
The European cybersecurity agency published the Threat Landscape 2025, analysing 4,875 incidents from 1 July 2024 to 30 June 2025. That is not an estimate made over coffee, it is a count.
Two numbers deserve your attention, because they show where the fight is genuinely lost. 60% of initial access points were phishing. Vulnerability exploitation was 21.3%. Did you catch that? The most common way in is not some exotic technical gap found by a genius at three in the morning. It is an email somebody opened!
ENISA describes ransomware as the most impactful threat in the EU. Denial of service attacks dominate the reported incident counts, but they overwhelmingly come from hacktivist groups targeting public administration, so that is not the risk profile of a small business. On those at least, sleep well.
WordPress and the great misunderstanding
WordPress has a bad security reputation. I will not tell you it is undeserved. I will tell you it is pointed at the wrong place.
According to Wordfence’s 2024 annual report, 8,223 vulnerabilities were published, roughly a 68% increase on 2023. Of those, only 5 affected core. 96% affected plugins, the rest themes. Read that again, it is not a typo. This is vendor data rather than independent research, and I owe you that caveat. But the same report adds the sober side: over 68% are considered low risk to most owners, because exploiting them requires a certain authentication level or user interaction.
So the conclusion is not “run away from WordPress”. It is that every plugin is a security decision. The WordPress documentation says it plainly: do not get plugins or themes from untrusted sources, restrict yourself to the official repository or well known companies. And it adds the part everybody forgets: once a fix is released, the information needed to exploit the flaw is almost certainly public. The clock starts when the fix ships, not when you read about it.
One detail that costs people: since version 5.6, new installations auto update core. For plugins and themes, automatic updates are not on by default. Anyone who assumes their site is updating itself is usually wrong exactly where it counts… and finds out late.
The six things that really make a difference
Scheduled updates. Not when you happen to remember! Nor when the red notification you have ignored for three months finally wears you down! And always with a backup taken first, so updating stops being frightening.
Fewer plugins. The most underrated security measure I know. Every plugin you do not use is third party code running on your server for no reason. On yachtsgreece.com we went from over 40 plugins down to 9, and the gain was not only in speed.
Strong authentication. Unique passwords, administrator rights only where needed, a second factor on the accounts that can change the site. Attacks on login forms are mass automated. Nobody singled you out, so do not take it personally.
Backups that have been tested. CISA’s 3-2-1 rule is simple: 3 copies, on 2 different media types, with 1 off-site. And note the word tested: a backup never restored is not a backup. It is a hope!
Security headers. This is the part TLS does not cover, because it concerns the application rather than the transport. Content-Security-Policy controls which resources the page may load and helps against cross-site scripting. Strict-Transport-Security enforces HTTPS and will not let the user click past a certificate error. X-Content-Type-Options: nosniff stops the browser executing as code something that was uploaded as a file.
Control over what gets uploaded. Forms that accept files, comments that accept HTML, fields that accept whatever you hand them without asking. That is where most get in, through a door we opened ourselves.
And if they do get you
Google documents four forms of hacked content: code injected into existing pages, new spammy pages created, existing content subtly manipulated with hidden elements, and redirects that send some visitors elsewhere.
Those last two are why so many people learn about the breach from Google rather than from their own site. The code often triggers only for visitors arriving from search, or on mobile. You open your homepage, finish your coffee in peace, and everything looks normal.
One more turn of the screw: hacked content is also a violation of Google’s spam policies. So the damage is not only technical, it is in your visibility too. You pay twice for the same incident.
Does NIS2 actually apply to you?
Directive (EU) 2022/2555 applies, on size, to entities of the types in Annexes I and II that are medium sized enterprises or larger. A typical small business falls outside on that rule. Relieved? Hold on half a minute…
There are also explicit exceptions regardless of size: providers of public electronic communications networks, trust service providers, top level domain name registries and DNS service providers, and entities that are the sole provider of an essential service in a member state. In a separate paragraph, again regardless of size, come entities providing domain name registration services.
In practice: the restaurant and the small agency are out on size. The small hosting or domain registration company may be in despite being small. The directive is transposed by national law in each member state, so what exactly applies to you needs checking against that national framework and, if the question matters, legal advice. You will not get that from an article.
Why this work never really ends
Security is not a state, it is maintenance. The WordPress documentation puts it well: this is about risk reduction, not risk elimination. Nobody can promise you that nothing will happen, and anyone who promises that is already lying to you.
What someone can promise is humbler and more useful: that you will know what is running, that there will be a backup that genuinely works, and that when something goes wrong there will be a procedure instead of panic. I have written separately about why cheap hosting costs more, because in practice the two subjects are the same subject.
Which brings us back to that padlock. It is good, we want it, nobody is taking it off. It is simply not a security door, it is a sealed envelope. If you want a check of what is actually running on your site, with a priority list rather than an automated report full of alarming colours, get in touch.