"I'll update it next week" is one of the most common sentences in small business web management, and most of the time, nothing bad happens. That's exactly what makes it a dangerous habit to get comfortable with — the risk isn't linear. A site can run on outdated plugins for two years without incident and then get compromised in a single afternoon. Here's what's actually happening behind that risk, and what recovery really looks like on both sides of the backup question.
How WordPress sites actually get compromised
Despite the headlines, WordPress itself is rarely the weak point — the core software has a dedicated security team and patches quickly. The vast majority of WordPress compromises trace back to outdated plugins and themes, not the core platform. A plugin with a known vulnerability is public information the moment a security researcher (or an attacker) discovers it. From there, automated bots scan millions of sites looking for that exact unpatched version — this isn't a targeted attack on your business specifically, it's a numbers game, and sites that haven't updated are simply easier targets.
A second common path is weak or reused admin credentials, often combined with no login limiting — bots brute-force common username/password combinations around the clock. Neither of these requires a sophisticated attacker. Both are almost entirely preventable with routine maintenance.
What a compromised site actually looks like
This rarely looks like the dramatic "hacked" screen people imagine. It's quieter, and often worse for that reason:
Search engines notice before you do. Google and other search engines actively crawl for malware and spam signatures. If your site gets flagged, visitors may see a "This site may be hacked" or "Deceptive site ahead" warning before they ever reach your homepage — and that warning doesn't disappear the moment you clean the site up. It takes a formal review and reinstatement process, which can take days.
Spam gets injected quietly into your own pages. A common pattern is invisible spam content — pharmaceutical links, gambling keywords, foreign-language link farms — injected into existing pages in a way that's invisible to a normal visitor but fully visible to search engines. This can tank rankings you've spent months building, and it's often not discovered until traffic has already dropped.
Your site gets used to attack other people. Compromised sites are frequently repurposed to send spam email, host phishing pages, or participate in larger botnets — meaning the damage isn't limited to your business; your domain's reputation (and your hosting account) can get flagged by email providers and security vendors well beyond the original issue.
Customer trust takes the real hit. Even a brief "hacked" warning, or a customer who notices something off about your site, is hard to walk back. For a business that depends on new visitors trusting it enough to pick up the phone or fill out a form, that's the most expensive part of the whole incident — and the part that's hardest to measure or refund.
Cleanup is rarely fast or cheap. A genuine malware cleanup means finding every injected file and database entry (attackers frequently leave more than one backdoor so they can get back in after the obvious one is removed), confirming the vulnerability that let them in is patched, and verifying search engines have re-crawled and cleared the site. Done properly, that's hours of specialized work — and it's reactive, unbudgeted work that didn't need to happen.
Why a backup that exists isn't the same as a backup that works
This is the part that catches people off guard. Having a backup running is not the same as having a usable backup. Backups fail silently more often than people expect — a plugin conflict corrupts the file, storage runs out mid-backup, a database table gets skipped. The failure is invisible until the exact moment you need the backup to work, which is the worst possible time to discover it doesn't.
A backup is only real if someone has actually restored it — to a staging environment, on a schedule — and confirmed the site comes back up intact. If nobody can tell you the last time that happened, you don't actually know whether you have a backup; you have a file that's probably fine.
Recovery: with a tested backup vs. without one
With a recent, tested backup: Identify the compromise, restore the site to the most recent clean backup, patch whatever vulnerability caused the issue, and bring the site back online. Realistically a few hours of focused work, and the business is back to normal the same day in most cases.
Without one: Every piece of malicious code has to be found and removed manually, line by line, across every file and database table, with no clean version to compare against. There's no guarantee the cleanup is complete — a missed backdoor means the same compromise can return within days. If the site truly can't be cleaned, the alternative is rebuilding from scratch, losing any content, orders, or form submissions that weren't backed up elsewhere. This can stretch from days into weeks, and in the worst cases, some data is simply gone for good.
The bottom line
Updates and backups aren't glamorous, and most months they feel like paying for nothing happening. That's the point. The cost of staying current is small and predictable. The cost of skipping it is unpredictable, occasionally severe, and always arrives at the worst possible time.