Photo by Christopher Gower on Unsplash
Most UK small businesses with a WordPress website have done it. You find a plugin that does exactly what you need, click install, and move on. The assumption behind that click is that something somewhere has already checked it is safe. For a long time, that assumption was more hope than fact.
WordPress has now changed that. Every plugin submitted for release through WordPress.org goes through an automated security review before the update API pushes it to live websites. The code gets checked before it reaches your dashboard, not after someone has already been hurt by it.
This is a genuine step forward. But it does not mean the install button is now risk-free. Here is what has actually changed, what it does not cover, and what a UK small business running WordPress still needs to do for itself.
What WordPress Has Actually Changed
Previously, new plugin releases could move from a developer's keyboard to your site's update queue with relatively limited automated oversight. The review process that existed was largely manual and could not keep pace with the volume of releases across tens of thousands of plugins in the directory.
The new system runs automated checks against every release before the update API distributes it. Think of it as a basic quality gate at the factory door rather than hoping problems get spotted once the product is already in shops. It will not catch everything, but it will catch common, well-understood vulnerability patterns before they reach the hundreds of millions of websites that run on WordPress globally.
Why Plugins Are One of the Biggest Risks for a Small Business Website
A WordPress site without plugins is a blank page. Plugins are how you add a contact form, an e-commerce checkout, a booking system, a newsletter sign-up, a cookie banner. Most small business sites have ten or more installed, sometimes far more.
Each one is a piece of third-party code that runs with access to your site's database and, depending on its function, potentially to customer data too. When a plugin has a security flaw, attackers do not need to target your business specifically. They scan for any site running a vulnerable version of that plugin and hit hundreds of thousands of them at once. This is not a theoretical scenario. It happens regularly, and small businesses are not exempt.
As we covered in a previous post on browser extensions, trusted tools can turn malicious without warning when they change hands or get compromised after the fact. The same principle applies to plugins. One you installed two years ago and have not thought about since may have had a vulnerability sitting in it for months.
What the Automated Checks Will Not Catch
Automated security scanning is good at finding known vulnerability patterns. It is not good at finding everything.
It will not catch a plugin that starts safe and is later modified by an attacker who has taken over a developer's account. It will not catch logic flaws that only become visible in a specific business context. It will not flag a plugin that has been quietly abandoned by its developer and is no longer receiving security fixes, even though it keeps working on your site until something breaks it.
And critically, the automated check covers the WordPress.org plugin directory. Premium plugins, plugins installed from other sources, and any custom-built code are outside its scope entirely.
What UK Small Businesses Should Still Be Doing
WordPress's new checks raise the baseline. They do not replace the steps your business needs to take for itself.
- Keep everything updated. WordPress core, plugins, and themes all need regular updates. A patched vulnerability does nothing for you if you are still running the old version. Automated patch management removes the dependency on someone remembering to log in and run updates manually.
- Remove what you do not use. Inactive plugins still run code and still attract attackers. If a plugin is not actively used, deactivate it and delete it.
- Check maintenance records before installing anything new. A plugin that has not been updated in two years is a risk regardless of its star rating. Active, well-maintained plugins are safer bets.
- Think about what sits behind your website. If your WordPress site collects customer data, takes bookings, or handles orders, a compromise is not just a website problem. It is a data breach. Consider whether your wider security posture (backups, endpoint protection, access controls) actually reflects that exposure.
- Scan for vulnerabilities in what is already there. Automated checks at submission time help, but regular vulnerability scanning of your live site tells you about risks already present, not just ones being introduced today.
The Bigger Picture
WordPress making its plugin ecosystem more secure is good news. It raises the floor for the entire platform. But your website is part of a broader attack surface that includes your email, your devices, your staff's habits, and the accounts connected to your business. A security control in one place does not substitute for the controls you have not yet put in place elsewhere.
If you are running a WordPress site and you are not sure whether the rest of your security measures are keeping pace, starting with a managed security review gives you a clear view of where the gaps are. It is far easier to find them before something goes wrong than to work backwards from a compromise.
The practical takeaway is straightforward: WordPress has made the plugin directory safer. Your job is to make sure your site, and the business it supports, is safer too. Update regularly, audit what you have installed, and make sure anything collecting customer data is protected end to end.