The Most Common Cyber Threats Facing Mid-Sized Businesses

Cybersecurity threats aren’t just a concern for large enterprises—small and mid-sized businesses are increasingly being targeted. In fact, a recent study by the U.S. Chamber of Commerce reports that 74% of small-to-mid-sized companies (20–500 employees) see cyber threats as a growing concern.

For mid-sized companies without dedicated security teams, a successful attack can lead to more than just site downtime—it can disrupt business operations, damage customer trust, and rack up devastating costs. 

This article explores why WordPress is a prime target for attackers, risks related to cybersecurity for mid-sized businesses, the most common cyber threats facing WordPress sites today, and how a managed hosting provider can help protect your site at a foundational level.

Why is WordPress a target for cyberattacks?

WordPress powers more than 40% of all websites globally, making it the most popular content management system (CMS) by far. 

This ubiquitousness makes WordPress sites attractive targets for hackers, as a single vulnerability in a plugin or line of code can create the potential for them to gain unauthorized access to millions of sites. 

The effect of cyberattacks on mid-sized organizations

After a cyberattack, the immediate effects are obvious: you may be completely locked out of your site’s administrative dashboard, have hackers reach out to you with a ransom to restore access, or maybe the company credit card suddenly starts racking up unexpected expenses.

The impacts of a cyberattack will almost inevitably affect your finances, but more than that, they can also affect your business operations and reputation in the long run.

Financial impacts of a cyberattack

The financial costs are the first and most obvious effect of a cyberattack on a mid-sized business. When cybercriminals access your site, oftentimes they’ll send a ransom note, offering to restore your site for a hefty price. However, it’s best practice not to engage with these criminals, as they may be tempted to keep raising the restoration price with no intention of reestablishing your site.

The alternative route of working with a cybersecurity firm to reclaim your site, while not a cheaper option, is often the better choice to ensure any money you pay is actually going toward work that may restore your business site.

That said, according to Huntress, mid-sized companies can expect to pay around a quarter of a million dollars to restore access to a site that has been compromised. Estimates from Wasatch Preferred are similar for mid-sized businesses experiencing a cybersecurity breach that does not result in business interruption. That estimate skyrockets, though, if business operations are interrupted, bringing the estimated total cost of a security incident up to nearly $ 1 M.

Additionally, lost customer data can open your business up to the potential for lawsuits, and these legal ramifications can further increase the financial burden on businesses already dealing with the fallout of a cyberattack. Unfortunately, Huntress’ findings also report that 60% of mid-sized companies permanently close within six months of a successful cyberattack due to the financial pressure it places on the business.

Operational impacts of a cyberattack

In the wake of a cyberattack, your business operations will also likely be affected. Here are a few examples of operational failures businesses may experience after a cyberattack:

• Online orders may not be processed, leaving a disconnect between customers who expect to receive products and vendors or warehouse fulfillment experts who are unaware of incoming requests. 
• Your customer support team may receive a massive influx of traffic as confused customers and partners reach out to problem-solve. 
• Interference with online payment processing can delay invoicing or lead to inaccurate financial statements.
• Compromised sites can also disrupt communication between scheduling software, internal systems, or payroll, affecting employees and their livelihoods.

For example, when one of the UK’s biggest retailers experienced a cyberattack, M&S was forced to stop taking online orders for over a week, resulting in millions in lost revenue. The company experienced issues that caused disruptions to a partner company, Ocado, which facilitated some of their online food deliveries, as well as in-store stocking issues, as shoppers turned away from digital, fulfilling their needs with in-store shopping at a higher-than-normal frequency.

Whether a site’s downtime results in supply chain disruptions, complications in vendor communications, or additional costs as you increase customer support and outreach, one thing is certain: a cyberattack costs more than just money—it costs valuable time and resources that mid-sized businesses simply can’t afford.

Reputational impacts of a cyberattack

Even after restoring full website functionality, your business will still have some damage to repair. Specifically, one of the most challenging hurdles to overcome after experiencing a cybersecurity breach is the reputational damage that comes with it.

Whether affected by the breach or not, past customers will be less likely to return, and new customers just finding you for the first time may be put off by uncovering a history of digital insecurity. If the attack affects your work with third-party vendors and specialists, they may also have concerns regarding the future of your professional partnership.

In an age where data protection is more difficult than ever, even a single story about a successful cyberattack against your site can deter some customers from working with you.

Most common cyber threats targeting WordPress sites

The most significant risk to your site is not in the tools you choose or the products you sell: it’s simple human error. 

By choosing a hosting partner—one with the special skills and technical expertise to manage your site’s security for you—you reduce that human error, and therefore reduce your chances of succumbing to security threats. 

Here are a few of the key threats facing WordPress sites that a managed hosting service is uniquely positioned to fight against.

Brute force attacks

A brute force attack involves hackers using automated tools to repeatedly guess login credentials until they gain access to a website. WordPress sites are particularly vulnerable because they allow unlimited login attempts by default and often use predictable usernames like “admin.”

Managed hosting providers can mitigate these attacks by implementing security measures such as Web Application Firewalls (WAFs) that detect and block malicious login attempts, limiting the number of login retries per IP address, and employing tools to block abusive IPs. 

These proactive defenses help protect WordPress sites from unauthorized access and potential downtime.

DDoS attack

A Distributed Denial-of-Service (DDoS) attack works by bombarding a website with an onslaught of useless traffic meant to overload the targeted site’s server and shut it down. Attackers will use a battery of compromised devices—like software applications run on computers, tablets, and even cell phones—to carry out a barrage of site requests. 

The intention behind a DDoS attack is to bring the targeted site to a functional halt. There are many reasons an attacker may want to bring down a business site, but the effect on small and mid-sized businesses can be immediate, especially if you use your site to sell products or generate leads. 

WP Engine’s advanced network includes Cloudflare CDN and layer 3 & 4 DDoS protection for all customers at no additional cost to help mitigate the risks posed by this pervasive cyber threat.

Outdated plugins and themes

Outdated WordPress plugins and themes expose websites to significant cyber threats. Attackers can exploit known vulnerabilities for unauthorized access, data theft, or malware injection when they remain unpatched. Notably, more than half of WordPress security breaches stem from outdated plugins.

Managed hosting providers can enhance security by automating updates for WordPress core, plugins, and themes, proactively monitoring sites for vulnerabilities, and conducting regular security scans to detect and remove malware promptly.

These proactive measures can help safeguard WordPress sites from threats associated with outdated plugins and themes without extra effort from your team.

SQL injection 

An SQL injection (SQLi) attack occurs when malicious SQL code is inserted into input fields (like a contact form) to manipulate a website’s database. This can lead to unauthorized access to and theft of data or even complete control over the site database. 

WordPress sites are particularly vulnerable due to their extensive use of plugins and themes, some of which may not properly sanitize user inputs, leaving entry points that attackers can exploit.

Managed hosting providers enhance WordPress security against SQLi attacks by implementing several protective measures, many of which will be similar to what you’d use for protecting against plugins or themes vulnerabilities, like firewalls or regular automatic updates. Input validation checks the accuracy and quality of source data before processing it.

By combining these strategies, you can work with your managed hosting provider to build a robust defense against SQL injection threats.

Cross-site scripting (XSS)

Another type of attack by code injection, cross-site scripting, also occurs when attackers inject malicious scripts via comments, contact forms, or plugins to steal data. 

There are two main differences between XSS and SQLi injection. The first is the type of code language under attack. SQL injection attacks primarily attempt to violate sites via SQL, while XSS attacks mainly affect JavaScript.

The second difference is that while an SQLi injection targets your site directly, XSS attacks target your end users. A successful XSS attack can result in a hacker impersonating your business to steal directly from customers who believe they’re making legitimate purchases.

Once again, a managed hosting partner can provide a foundational level of security through WAFs and automatic updates to mitigate the risk of attackers making money from your hard-earned reputation.

Squash these security threats and more with WP Engine

Cybersecurity for mid-sized companies is tricky—you’re working with a lean team to keep your site safe and fast for your users, and finding the right balance is no small task. 

WP Engine is designed with WordPress security in mind, keeping our customers’ sites safe and scalable. To learn more about our managed hosting for WordPress sites, check out our flexible plans to see which is right for your business!