It's 2026, we've got AI writing our emails, quantum computing on the horizon, and yet... phishing is still the number one way attackers walk through the front door of small businesses. A recent report highlighted that nearly half of UK firms got breached in the last year, and phishing is doing most of the heavy lifting. The same trick that worked in 2005 is still working today, just with better grammar and a slicker fake login page.
If you run a website, manage a WordPress site, or own a hosting account, this matters to you directly. One employee clicking one dodgy link can hand over the keys to your cPanel, your email, your customer database, the lot. The good news? You don't need a six-figure security budget to fight back. You just need a practical playbook, and we've got you covered.
Why Phishing Still Works (And Why SMBs Are the Juicy Target)
Phishing works because it doesn't attack your software, it attacks your people. Attackers don't need to find a zero-day exploit when they can just send Sarah from accounts a fake invoice email that drops her straight onto a convincing Microsoft 365 login page. She types in her credentials, gets a 'session expired' error, shrugs, and moves on. Meanwhile, attackers are already inside your inbox.
Small and medium businesses are particularly attractive because they often sit in a sweet spot: enough money and data to be worth stealing, but rarely enough security staff to catch attacks early. Many SMBs assume they're too small to be targeted, but automated phishing campaigns don't care about your headcount. They scrape email addresses, fire off thousands of messages, and wait for the clicks.
And in 2026, the lures are nastier than ever. AI-generated phishing emails are nearly indistinguishable from legitimate ones. Fake supplier invoices, cloned booking confirmations, even deepfake voice notes asking for urgent transfers, it's all out there. The defence has to be just as smart.
Lock Down the Big Three: cPanel, WP-Admin, and Email
If you take one thing away from this post, let it be this: turn on two-factor authentication (2FA) everywhere it's offered. Especially on these three accounts, which are the crown jewels of any website owner.
cPanel is the master key to your hosting. If an attacker gets in, they can install malware, redirect your domain, exfiltrate your database, or hold the whole thing for ransom. At TPC Hosting, 2FA is built straight into your control panel, and it takes about ninety seconds to enable. There's no reason not to.
WP-Admin is the next big target. Once attackers have admin access to WordPress, they can inject malicious scripts, redirect your visitors, or use your site to host their own phishing pages, getting you blacklisted by Google in the process. Use a reputable 2FA plugin, enforce strong passwords, and limit login attempts. Bonus points for changing the default /wp-admin URL.
Email accounts are often forgotten but absolutely critical. Why? Because email is how attackers reset every other password. Compromise the inbox and you compromise everything connected to it. Enable 2FA on every business email address, and consider using app-based authenticators rather than SMS, which can be SIM-swapped.
Train Your Team Like Their Jobs Depend on It (Because They Do)
Technology can only do so much. The strongest firewall in the world won't stop someone clicking 'Enable Macros' on a malicious Word doc. Staff training is the single highest-ROI security investment most SMBs can make, and it doesn't have to be expensive or boring.
Start with the basics. Teach your team to hover over links before clicking, to verify unusual requests via a second channel (like a quick phone call), and to be suspicious of urgency. Phishing emails almost always create artificial pressure: 'Your account will be suspended in 24 hours!' or 'Urgent invoice attached, pay today!' If something feels rushed, that's the red flag.
Run simulated phishing tests every quarter. Plenty of affordable tools will send fake phishing emails to your staff and report who clicked. The goal isn't to shame people, it's to identify training gaps and build muscle memory. After a few rounds, your team will start spotting the real ones too.
Build a Layered Defence That Catches What Slips Through
Even with great training and 2FA, something will eventually slip through. That's why you want layers, so when one defence fails, the next one catches it.
On the email side, make sure your domain has SPF, DKIM, and DMARC records properly configured. These stop attackers from spoofing your domain to phish your customers and partners. If you're not sure how yours is set up, the TPC Hosting support team can walk you through it, it's a quick win that most businesses overlook.
On the website side, keep WordPress core, themes, and plugins updated automatically. Use a web application firewall to block known attack patterns. Take regular off-site backups so that if the worst happens, you can roll back in minutes rather than days. And monitor your login logs, unusual login locations or repeated failures are early warning signs that someone's trying to get in.
Finally, have an incident response plan, even a simple one. Who do you call? How do you reset credentials? How do you notify customers if data was exposed? Writing this down before something happens makes a stressful day far less catastrophic.
FAQ
Is SMS-based 2FA good enough for my hosting account?
It's better than nothing, but app-based authenticators like Google Authenticator or Authy are stronger because they can't be intercepted via SIM-swapping attacks. For critical accounts like cPanel and email, use an authenticator app where possible.
How often should I run phishing simulations for my team?
Quarterly is a solid baseline for most SMBs. It's frequent enough to keep awareness high without becoming background noise. Mix up the scenarios, fake invoices, fake delivery notices, fake internal HR emails, so staff stay sharp.
What should I do if an employee has clicked a phishing link?
Act fast. Immediately reset their password, revoke active sessions, and check for any forwarding rules added to their email. Review login logs across cPanel, WordPress, and email for suspicious activity. Then notify your team so others can watch for follow-up attacks.
