A Devon small business website is, in practical terms, three things: the WordPress install (code and design), the database (pages, posts, users, orders, comments), and the uploads folder (images, PDFs, documents). Lose any of those and your website is gone. Compromise any of them and your business looks unprofessional, your Google rankings tank, and your customers stop trusting you.
This piece is a practical guide to protecting all three.
The realistic threats to a small business website
In 26 years of running websites for Devon clients, the things that have actually broken sites are, in order:
We are ready to talk things through!
Contact Here- Plugin or theme update conflicts. A WordPress update breaks an old plugin, the page builder fails, the homepage shows a white screen. Most common cause of a "my website is down" call.
- Server failure or hosting provider issues. The server crashes, the host doesn't have a recent backup, the website's gone for 48 hours.
- Hacked WordPress install. Usually through an unpatched plugin vulnerability. Site gets defaced, used to send spam, or used to host phishing pages.
- Accidental human error. Owner deletes the homepage, breaks the menu, uploads a corrupt image, or installs a dodgy plugin.
- Ransomware on the office computer that propagates through synced cloud drives. Less common than the above for websites specifically, but devastating when it happens.
The defences against all five overlap heavily. You don't need a different strategy for each.
The four-layer protection model we use
Layer 1: Daily backups, off-site, automatic. UpdraftPlus or BlogVault running daily, with backups going to a separate cloud account (Dropbox, Google Drive, Amazon S3). The key word is separate — if the website gets compromised and the backups are stored on the same server, you've lost both. Hosted clients on our £300/month retainer get this as standard.
Layer 2: Plugin, theme and WordPress core updates. Monthly minimum, ideally fortnightly. Yes, an update can break a site. The frequency you do them protects you because if something breaks, the change set is small enough to debug quickly. The businesses that get hacked are usually the ones who haven't updated in eighteen months.
Layer 3: Active malware scanning and a firewall. Wordfence (free or £99/year for Premium) is the standard small-business choice. It blocks known bad IPs, scans for compromised files, and alerts you if something changes that shouldn't have. Enabled by default on every site we host.
Layer 4: A working SSL certificate, HTTPS-only, and basic hardening. Force HTTPS, hide WP admin behind a custom URL, two-factor authentication on the admin login, restrict login attempts to slow brute-force attacks. These take an hour to set up properly and are non-negotiable.
What recovery actually looks like
When a site does get compromised or break, the recovery process for a properly backed-up site is straightforward:
- Confirm what's wrong (database corruption, file infection, plugin conflict)
- Restore the most recent clean backup to a staging environment
- Identify what broke (often the same plugin will re-break it, so you need to know)
- Replace or remove the offending element
- Push the cleaned backup back to production
- Change all passwords and admin keys
- Re-scan for residual infection
For a hosted retainer client this typically takes 2-6 hours. Without backups, recovery is rebuild-from-scratch, which is days of work and a permanent loss of any data not preserved elsewhere.
What's overhyped
Premium "security suites" that bundle ten features. Most are repackaged free plugins. Wordfence + UpdraftPlus + careful update discipline covers 95% of what those bundles offer.
"Quantum-resistant encryption" anything. Marketing nonsense for small businesses. Standard SSL is fine.
Annual penetration tests for small business sites. Useful for sites handling sensitive data at scale, wasted money for a typical Devon high-street business website.
What it costs
Bundled into our £300/month retainer: backups, updates, malware scanning, hardening, SSL, monitoring. Standalone setup-and-walk-away configuration is a one-off £150-£250 if you'd rather we configure it and you'd rather manage updates yourself.
Get started
Call or WhatsApp 07887 988780, or use the free quote form. If your current website hasn't been backed up in the last seven days, fix that this week. The rest can follow.