“We have nothing worth hacking” is not how it works

The mental model most owners have is a person deciding to attack their business. That is not what happens. What happens is automated scanning that tries known weaknesses against every address it can find, and takes whatever it gets.

What they actually want

• A server to send spam from, which costs you your email reputation.
• Somewhere to host something illegal behind your domain name.
• Your customer list, if you keep one.
• Your payment details, or your customers'.

None of that requires you to be interesting. It requires you to be reachable and out of date.

The short list that prevents most of it

• Keep the site and its plugins updated — most breaches use a fix that already existed.
• Two-factor authentication on the domain, the hosting and your email.
• A working backup you have actually tested restoring.
• HTTPS, which is free and also affects how browsers label you.

None of this is a project. It is four settings and a habit.