Do small websites really get hacked?

Constantly, because attacks are automated and indiscriminate: bots scan every site on the internet for outdated software and exposed admin panels. Small sites are not targets; they are inventory. Updates, strong authentication and backups remove you from the easy pile.