You can have two WordPress sites using the exact same theme and still end up with very different security problems.
That catches a lot of small business owners off guard. They assume the risky bit is the theme because that’s the thing they bought, installed, and can actually see. Fair enough. But honestly, the bigger mess is usually hiding underneath – old PHP, a bloated plugin stack, or sloppy file permissions that let bad things happen quietly.
And quiet is how most WordPress trouble starts.
If your site runs fine today, that doesn’t always mean it’s healthy. A bakery site with 11 pages, a gym booking site, and a local accountant’s homepage can all look normal on the front end while the backend is held together with old software and crossed fingers. I’ve seen this alot.
The theme often gets blamed first. That’s not always the real problem.
Let’s say your site uses a decent premium theme from 2022. Nothing weird. It’s updated a few times a year. Good start.
But the server is still on PHP 7.4. Or worse, 7.3. That means the theme may be fine while the actual engine underneath WordPress is running software that stopped getting security support a while ago. That’s a very different risk. Same theme, same design, same contact form on the page. Totally different exposure.
PHP is the language WordPress runs on. If the version is old, attackers have more known weaknesses to work with, and newer plugins may behave strangely too. Not always dramatic. Sometimes it’s subtler. A plugin update gets skipped because “it caused warnings last time.” Then another one gets skipped. Six months later you’re stuck on old code because the whole stack is fragile.
Sound familiar?
If you want a plain-English reminder of why websites should be built with ongoing care in mind, this article is worth a read: Build for maintenance, not just launch.
Here’s what to do:
- Check your PHP version in hosting or ask your host directly
- If it’s below PHP 8.1, put “upgrade path” on your list this month
- Test the site after changing PHP – forms, checkout, login, quote requests, everything that makes you money
- If something breaks, don’t roll back and forget it forever. Find the incompatible plugin or theme part and deal with that specific thing
That last bit matters. The old version is rarely the safer option just because it’s familiar.
The plugin pile is where small sites get weird
A plugin pile doesn’t always mean 80 plugins. Sometimes 23 is enough if half of them overlap, three are abandoned, and one was installed for a popup campaign in 2021 and never touched again.
This is where “same theme, different risk” gets really obvious. Two plumbers might both use Astra or Kadence or some page builder theme. One site has 9 actively maintained plugins. The other has 47, including an old slider, duplicate SEO tools, a backup plugin that hasn’t run in months, and a mystery plugin no one wants to delete because nobody remembers what it does. Guess which one gets into trouble first.
Yep.
Plugins add code. More code means more moving parts, more update conflicts, more possible vulnerabilities, more places for a careless developer to leave something ugly behind. And every extra admin feature usually means extra scripts, extra database junk, extra headaches later.
I’m not anti-plugin, by the way. WordPress without plugins would be a pretty boring machine. But small business sites usually need fewer than people think.
A quick plugin cleanup usually means asking blunt questions:
- Do we still use this?
- Has it been updated recently by the developer?
- Does another plugin already do the same job?
- Would the site actually break if we removed it properly?
If you already suspect your stack got out of hand, this article gets into the security side of that problem nicely: The Hidden Danger of Abandoned Plugins on Your WordPress Site.
And don’t just deactivate junk. Remove it fully after checking what depends on it. Deactivated plugins can still sit there getting old and forgotten. That’s not harmless. It’s clutter with teeth.
File permissions: boring topic, real damage
This is the part most owners never hear about until something goes wrong.
File permissions decide who can read, write, and execute files on your server. If they’re too loose, an attacker who gets a foothold through one weak plugin may be able to modify way more than they should. That can mean backdoors dropped into theme files, spam pages generated in writable folders, or malware that keeps coming back after a cleanup. Nasty stuff.
For a standard WordPress setup, the usual safe baseline is pretty simple:
- Files: 644
- Folders: 755
- wp-config.php: often 600 or 640, depending on hosting
You don’t need to memorize that forever. Just know that “777” is almost never the answer, even if some random forum post told your developer to use it ten years ago. I’ve seen 777 permissions used as a lazy fix for upload problems. Big mistake.
And yes, file permissions can be changed through hosting panels, SSH, or FTP tools. But if you’re not comfortable there, don’t poke around blindly. It’s very possible to lock your own site out or break uploads. This is one of those areas where a careful maintenance setup saves time and panicky emails later.
If you need ongoing help with that kind of behind-the-scenes upkeep, that’s exactly what a WordPress maintenance service should be handling regularly.
These three problems tend to travel together
Here’s the thing. Old PHP, too many plugins, and bad file permissions are rarely seperate little issues.
They stack.
A site with outdated PHP often avoids updates because something might break. A site that avoids updates usually keeps old plugins around longer. A site with old plugins often gets weird permission changes over the years because someone needed a “quick fix” to make uploads work, install a theme, or patch a broken form. Bit by bit, the site turns into a fragile little tower.
Then one day a contact form stops sending. Or customers get redirected to a fake pharmacy page on mobile. Or Google starts warning people away. That’s why treating these as one-off technical details misses the point. They’re signs of overall site condition.
Think of it like a van your business relies on. Bald tyres, old oil, and a dodgy side door are different problems. Sure. But together they tell you the van isn’t being looked after properly.
A simple cleanup plan you can actually use
You don’t need a giant security project. For most small businesses, this is enough to get moving:
Week 1: Find out your PHP version and ask your host whether your server supports 8.1 or 8.2. If your host makes this hard, that’s a small red flag already.
Week 2: Export a list of plugins. Mark the ones that are unused, duplicated, outdated, or no longer supported. Be ruthless, but not reckless.
Week 3: Review file permissions, especially wp-config.php, wp-content, uploads, and plugin folders. If you don’t know what you’re looking at, get help before changing things.
Week 4: Add some basic hardening so the site isn’t relying on luck. A decent setup with login protection, malware scanning, and safe defaults goes a long way. Tools like one-click hardening can cover several of those easy wins without turning your dashboard into a spaceship.
That’s it. Not glamorous. Very effective.
What small business owners should stop assuming
Stop assuming your developer is checking this unless they’ve said so clearly. Stop assuming your host is handling WordPress-level security just because they send backup emails. And stop assuming a nice theme means a safe site.
Those are different things.
A polished homepage can sit on top of neglected infrastructure for years. Then the bill arrives all at once – downtime, cleanup costs, lost enquiries, awkward customer messages, maybe a blacklisted domain if it gets bad enough. Nobody wants that phone call on a Monday morning.
So yes, the theme matters. But the bigger story is usually under the hood. PHP version. Plugin pile. File permissions. Fix those, and you reduce a surprising amount of risk without rebuilding the whole site from scratch.
And honestly, that’s the part most small businesses need. Less drama. Fewer hidden problems. A website that just behaves itself.