Small business sites do not get attacked by masterminds. They get attacked by scripts: automated campaigns that sweep the whole internet looking for the same handful of open doors. Which means a modest, boring baseline blocks the overwhelming majority of what will ever hit you. Here it is, doable in one sitting.
1. Updates on autopilot (10 minutes)
Outdated software is the number one entry point. Turn on automatic updates for WordPress core and plugins, remove plugins you no longer use, and check that PHP is a currently supported version. Fewer plugins means fewer doors.
2. Backups that live somewhere else (5 minutes)
Verify you have automatic backups, that they go to storage outside the server, and that you know how to restore one. A backup you have never restored is a hope, not a plan. This is not attack prevention; it is the guarantee that no attack is fatal.
3. Lock the login (5 minutes)
Two-factor authentication for every administrator account, no shared logins, no user called admin. With 2FA on, the entire category of password guessing attacks, including the ones amplified through xmlrpc.php, stops working.
4. Headers at the edge (5 minutes)
If your site runs behind Cloudflare or any CDN, add the basic security headers there: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. No server changes, effective immediately. Leave Content-Security-Policy for a careful report-only rollout later; it is the one header worth doing slowly.
5. Close the public files (5 minutes)
Check that /.env, /wp-config.php.bak, /readme.html and /xmlrpc.php are not answering. Block backup file patterns and hidden files at the edge so the next accidental leftover is covered too.
6. Re-scan on a schedule
Security drifts: a plugin update re-enables something, a migration leaves a file behind. Put a quarterly reminder in the calendar, or let a tool do the remembering. A free AuditMerlin scan covers points 4 and 5 in about a minute, shows exactly what is missing, and on the Pro plan re-checks your sites and applies the Cloudflare fixes with one click.
None of this makes a website unhackable; nothing does. It makes you a target that costs more to attack than the site next door, and for automated attacks that is the whole game.