AI and website security: what Australian small businesses should do
Australia's cyber agency says AI is helping attackers work at a larger scale and a faster rate, and write more convincing phishing emails (ASD's ACSC). On WordPress, the most heavily exploited flaws were first attacked about five hours after going public (Patchstack). The answer isn't new: keep software updated, protect your logins with multi-factor authentication, keep tested backups, remove plugins you don't use, and set up your email properly. The 62-second video below covers it; the steps are under it.
By Jarek Piotrowski · Last updated
Read the transcript
Is your website one plugin update away from a problem?
Australia's cyber agency says AI is helping attackers work faster and at scale, including more convincing phishing emails.
On WordPress, the most heavily attacked flaws were first exploited about five hours after they went public.
So the basics matter more than ever: updates, strong logins, backups, and properly set-up email.
Start free. Our WordPress vulnerabilities page is updated weekly.
Want it checked? The hardening check covers updates, logins and backups. A$390, flat.
Already hacked? Book a free 15-minute assessment. Clean-up is from A$690, on a fixed quote.
Website form sending through Microsoft 365 with just a password? That changes in December. The email sending fix is A$490.
No one can promise a site can't be hacked. But a patched site is much harder to break into.
LayerOps. Check it free, then fix it for a fixed price.
Sources: ASD's ACSC Annual Cyber Threat Report 2024–25, pp.10 and 34; Patchstack, State of WordPress Security in 2026. Scenes and voice are AI-generated; the vulnerabilities page shown is a real capture (Wordfence data as of 23 Oct 2026).
What AI changes
In its Annual Cyber Threat Report 2024–25, ASD's Australian Cyber Security Centre says AI "almost certainly enables malicious cyber actors to execute attacks on a larger scale and at a faster rate" (p.10), and that cybercriminals use generative AI to create "spearphishing emails to more convincingly present themselves to victims as legitimate actors with relatively minimal effort" (p.34; the report).
For a small business that means two things: flaws in your website software get found and tried sooner, and a fake email asking a client to pay a new account can read like it came from you.
How fast WordPress flaws are attacked
Patchstack's State of WordPress Security in 2026 puts "the weighted median time to first exploit" at 5 hours for heavily exploited vulnerabilities (Patchstack). Not every flaw is attacked that fast: the figure is for the flaws attackers target most. That leaves little time to update by hand, which is why automatic updates matter. Our WordPress vulnerabilities page counted 1,613 new WordPress vulnerabilities in 1–25 October 2026 (Wordfence data); 26% had no patched version listed when we counted.
Five things to do this week
- Updates. Update WordPress core, plugins and themes, and turn on automatic updates where you can. For a plugin with no patch yet, switch it off or replace it until one ships.
- Logins and multi-factor authentication. A unique password and multi-factor authentication on your website admin, hosting, domain registrar and email. ASD's ACSC calls multi-factor authentication "one of the most effective controls an organisation can implement" to keep attackers out (ACSC guidance). Remove admin accounts nobody uses.
- Backups. Automatic backups kept away from the website's own server, and one test restore, so you know they work.
- Plugin hygiene. Delete plugins and themes you don't use: deactivated code can still be reached. Fewer plugins means fewer things to patch.
- Email authentication. SPF lists the servers allowed to send email for your domain, and DKIM signs your real email so a receiver can check it. DMARC tells them what to do with mail that fails: at
p=noneit only reports, and fake mail using your domain is still delivered; atquarantineorrejectit's sent to junk or refused (RFC 7489). Start atp=none, read the reports, then move to enforcement once your real mail passes (Microsoft's DMARC guide). Google recommends all three for every domain (Google's sender guidelines). DMARC protects your own domain name, not lookalike domains.
No one can promise a site can't be hacked. A patched site with locked-down logins and tested backups is much harder to break into, and much quicker to recover.
When to get help
- Free: this month's WordPress vulnerabilities, updated weekly from Wordfence data, and what to do about them.
- Want it checked? The WordPress hardening check is $390 flat: updates, plugins, accounts, logins, backups and server basics, with a written, ranked fix list. Done only with your written OK.
- Already hacked? Hacked WordPress clean-up is from $690, on a fixed quote after a free 15-minute assessment.
- Email: the email sending fix is $490: the Microsoft 365 / website-form sending change, SPF and DKIM aligned, a DMARC record published at
p=nonewith reports, and advice on moving it to enforcement once the reports are clean.
Want it done for you? See hacked WordPress clean-up and the hardening check ($390 flat), or the email sending fix ($490).
Jarek Piotrowski runs LayerOps from Canberra: fast, lead-ready websites, and SEO and AI-answer visibility for professional and service businesses Australia-wide.