Most property managers think of website security as an IT problem that lives somewhere behind the site. It is not. It is a leasing problem, a compliance problem, and starting this October it is a problem your renters will see in their browser before they see your homepage. Here is what changed in 2026 and the checklist that fixes it.
In October, Chrome starts warning people before your site loads
Google announced that Chrome will turn on "Always Use Secure Connections" by default in Chrome 154, releasing in October 2026. From that release, a visitor heading to a public site that still runs on plain HTTP gets a full warning dialog first, telling them the site does not support a secure connection and that attackers could view or change what they send. A limited version of this already started rolling out in Chrome 147 in April 2026 for people using Enhanced Safe Browsing.
For a property manager, that is the difference between a prospect landing on a vacancy page and a prospect being asked whether they really want to continue. Most modern sites already redirect to HTTPS, so the risk is rarely the homepage. It is the leftovers: an old landing page from a campaign, a subdomain pointed at a legacy listing tool, an application form still posting to an insecure address, a PDF of a lease application sitting on an unmigrated host. Any one of them can produce that warning, and the visitor will not stop to work out which part of your setup is at fault.
The fix is not complicated. Certificates are free and automatic on every serious host. What takes the time is finding every URL you still publish, including the ones printed on yard signs and inside your listing syndication feeds, and confirming each one lands on HTTPS without a mixed-content warning. Do that before October and the change is invisible to your renters, which is exactly the outcome you want.
Where the risk actually comes from
Nobody is hand-picking your property management company for a targeted attack. What happens instead is automated. A vulnerability gets published in a widely installed plugin, scanners start sweeping the internet for sites running that plugin within hours, and every unpatched site gets hit at the same time. It is indiscriminate, and being small does not exclude you.
The WordPress ecosystem in 2025
11,334
new vulnerabilities found across the ecosystem, up 42% on the year before
91%
of them sat in plugins. WordPress core accounted for six
46%
had no patch available on the day they were publicly disclosed
Source: Patchstack, State of WordPress Security in 2026, covering vulnerabilities disclosed during 2025.
Read those three numbers together and the lesson is specific. The platform is not the weak point, the pile of add-ons bolted onto it is. A site running eight plugins is a much smaller target than the same site running forty, and the forty-plugin version is the one most agencies hand over, because every request during the build got solved by installing something.
The wider data points the same way. Verizon's 2026 Data Breach Investigations Report found that 31 percent of breaches now begin with the exploitation of a software vulnerability, which has pushed stolen credentials out of the top spot, and that close to half of all incidents now involve ransomware. Sucuri's analysis of sites it cleaned found 39.1 percent were running an out-of-date CMS at the moment of infection and 49.21 percent had at least one backdoor left behind, which is the part people underestimate. Getting hacked is one event. Staying hacked, quietly, for months, is what actually costs you.
Your website holds more sensitive data than you think
An online store collects a name, an address, and a card number that the customer can cancel in a phone call. A rental application collects a Social Security number, employment history, bank details, a copy of a government ID, and current address. It is closer to a loan application than a checkout. That changes what a compromise means, and it should change how the site is built.
| What the site touches | Where it usually ends up | Why it matters |
|---|---|---|
| Rental applications | Your PM software, or a form plugin's database | Identity-grade data. The one record most likely to trigger a breach notification |
| Rent payments | The portal and its payment processor | The processor carries the card data, but your site is what points residents at it |
| Maintenance requests | Portal or ticketing system, often with photos | Reveals unit access details, occupancy patterns, and who lives alone |
| Owner inquiries | A CRM connected to your contact form | Your pipeline. The single list a competitor would most like to have |
| Staff logins | Your CMS, often shared between people | One reused admin password is the whole website |
Privacy law caught up with your contact form
Twenty comprehensive state consumer privacy laws were in effect at the start of 2026, and the count of states that have enacted one had reached twenty-four by the middle of the year. Property management is an unusually exposed industry here, because you tend to operate across city and state lines while running one website for all of it. The law that applies is generally the one where your resident lives, not where your office sits.
In practice this lands on three parts of the site. A privacy policy that actually describes what you collect and who you share it with, written for a resident rather than for a lawyer. Honest handling of tracking, since the advertising and analytics tags on a listing page are exactly the data sharing these laws are aimed at. And a working way for someone to ask what you hold on them and to ask you to delete it, which needs to be a real inbox somebody reads, not a form that goes nowhere.
The financial argument is easier to make than it used to be. IBM's 2025 Cost of a Data Breach report put the global average breach at 4.44 million dollars and the United States average at an all-time high of 10.22 million. Those figures are weighted heavily by large enterprises and are not a forecast for a regional property manager. The more transferable finding is that a third of breached organizations paid a regulatory fine, and 48 percent of those fines came in above 100,000 dollars. Fines scale down far less gracefully than revenue does.
Security is also a conversion problem
This is the part that gets missed, and it is the part that touches your leasing numbers every week. Renters are being asked to hand over their identity through a form on a website they found ten minutes ago. Anything that makes that feel risky costs you the application.
Thales surveyed more than 15,000 people across twelve countries in early 2026 for its Digital Trust Index and found that 57 percent had trouble accessing a website in the previous year, and that 68 percent abandoned a provider or switched to another one because of slow performance or a complicated sign-up process. Confidence in sharing personal information varies enormously by industry, from 57 percent for banking down to single digits for hospitality, so consumer patience is not evenly distributed and property management is not sitting at the trusted end of that scale. On the other side, 69 percent said multifactor authentication increases their trust in a brand, which means the security measures your residents can see are worth showing rather than hiding.
So the practical version is simple. Say what happens to an application before someone starts filling it in. Name the software that holds it. Keep the screening fee page honest about what is charged and when. A short line of plain text next to a form does more for completion rates than any trust badge graphic, and unlike the badge it is also true.
The eight-step checklist
Get every URL onto HTTPS before October
Not just the homepage. Old campaign pages, subdomains, syndication feed links, and anything printed on a sign. Test each one for mixed content, not only for a padlock.
Cut your plugin count
91 percent of ecosystem vulnerabilities live in plugins. Remove anything you cannot name a purpose for, and never leave a deactivated plugin installed. Deactivated code is still on the server.
Turn on automatic security updates
Auto-update minor core releases and security patches, and check monthly for anything abandoned. A plugin with no update in two years is a liability regardless of whether it still works.
Put multifactor authentication on every admin account
One account per person, no shared logins, and remove staff the day they leave. This is the cheapest control available and it stops the most common takeover.
Stop collecting what you do not need
Route applications straight into your property management software rather than storing Social Security numbers in a form plugin database. Data you never held cannot be stolen from you.
Run backups you have actually restored
Daily, stored off the server, retained at least 30 days. Restore one to a staging site twice a year. An untested backup is a guess, and ransomware is what turns the guess into a bad day.
Add a firewall and uptime monitoring
A web application firewall blocks the automated sweeps that follow every public disclosure. Uptime and malware monitoring tell you within minutes rather than when a renter emails you.
Write the privacy page like a person
What you collect, why, who you share it with, how to request deletion, and a monitored address to send that request to. Review it whenever a state you operate in adds a law.
The bottom line
Website security stopped being invisible this year. In October, Chrome will put a warning in front of any public page still served over HTTP, so the first thing a prospect sees is a reason to leave. Behind that, the volume of published vulnerabilities keeps climbing and almost all of it sits in the plugins layered onto your site rather than the platform underneath. And the data you collect through a rental application is more sensitive than what most online stores handle, in an industry where you are already asking strangers for a lot of trust. Fix the certificate, cut the plugin count, turn on multifactor authentication, keep restorable backups, and be straight with people about what you do with their information. None of that is expensive. All of it is much cheaper than the alternative.
