Website Security Checklist for UK Small Businesses

A secure small business website comes down to ten habits: HTTPS everywhere, software kept up to date, strong and unique logins with two-step verification, tight user permissions, tested backups, a clean list of plugins and themes, a sound host, regular scans, a written breach plan and a named person who owns all of it. Do those and you remove most of what automated attacks rely on. None of it makes a site unhackable, and no checklist can promise that. This guide goes through each item in the order we would check it, with the UK rules that apply and what to ask whoever looks after your site.

TL;DR

• Every page should load over HTTPS, and plain HTTP should redirect to it. Check it with the free NCSC Check your cyber security service.
• Keep your CMS, themes and plugins updated, and delete anything you do not use.
• Use unique passwords, a password manager and two-step verification on your host, domain, email and website admin.
• Keep backups that an attacker cannot reach, and test a restore. If personal data is lost, you may have 72 hours to tell the ICO.
• If you are not technical, hand the routine work to a provider and ask them to show you what they do each month.

Table of Contents

• Why a small site is still a target
• The website security checklist
• What UK GDPR expects of you
• WordPress-specific checks
• What to ask your web provider
• Our perspective: security is a routine, not a feature
• How we handle it at TK Marketing
• A 30-minute quarterly routine
• FAQ
• Sources

Why a small site is still a target

Most website attacks are not personal. Bots scan the internet for old plugin versions, weak passwords and misconfigured servers, and they do not care whether the site belongs to a plumber in Corsham or a national retailer. The NCSC says around 1 in 2 UK small businesses has a cyber incident each year, and roughly 1 in 4 experiences cyber crime.

For a trade business the damage is usually practical rather than dramatic. The site goes down in the week you most need calls. A hacked page sends visitors to a spam site. Your enquiry form is quietly altered. Google may warn people off. And if your contact form or customer list holds names, phone numbers and addresses, you also have legal duties, covered below.

The website security checklist

Work down this list once, then repeat it every quarter. Each item says what to do and how to check it.

1. Force HTTPS on every page

HTTPS encrypts the traffic between your visitor and your site. Your address should start with https:// on every page, and anyone typing the old http:// address should be redirected automatically. The NCSC’s guidance on website configuration covers redirecting HTTP to HTTPS, current TLS versions and HSTS, which tells browsers to use HTTPS only.

How to check: type your address with http:// in front and see whether it jumps to https://. Click the padlock and confirm the certificate has not expired. Most good hosts renew certificates automatically, but ask rather than assume.

2. Run a free external scan

You do not need technical skills to get a second opinion. The NCSC’s Check your cyber security service runs remote checks on your website and IP address for common vulnerabilities, using the same publicly available information criminals use. The NCSC’s Web Check service monitors websites for common issues that can be detected automatically and gives advice on fixing them.

Treat the results as a to-do list. Send them to whoever manages your site and ask for a date by which each item is fixed or explained.

3. Update everything, on a schedule

Outdated software is the single most common way in. That means your CMS (WordPress, for example), your theme, every plugin, and the server software your host runs. Updates fix known holes, and attackers read the same release notes you do.

A sensible routine for WordPress sites:

1. Switch on automatic updates for minor releases and security fixes.
2. Test major updates on a staging copy of the site before they go live, so a plugin clash does not take your contact form down.
3. Log the date of each update, so you can show what was done and when.

This is the reason ongoing management matters more than the launch. A site that was safe in March can be exposed by September if nobody has touched it.

4. Delete what you do not use

Every plugin, theme and old user account is something that can be attacked. Deactivated is not the same as deleted. Remove unused plugins and themes entirely, along with test pages and staging sites left online. Security experts consistently advise managing the attack surface rather than piling on security plugins. A smaller site has fewer things to patch.

5. Lock down logins

This one catches out more small businesses than any technical flaw.

• Replace the default “admin” username with something else.
• Use a long, unique password for every account. A password manager does the remembering.
• Turn on two-step verification for your website admin, hosting account, domain registrar, email and Google Business Profile.
• Limit login attempts, so bots cannot guess endlessly.
• Give staff and freelancers their own accounts, with the lowest level of access that lets them do the job, and remove them when they leave.

The ICO’s 2025 decision to fine a password manager provider is a useful reminder that account security is not only about your own site. It found that a breach started with an employee’s personal device and the reuse of access between work and personal accounts. Keep business accounts separate from personal ones, and do not share one master password across both.

6. Protect your domain and email

Your domain name is the keys to the building. If someone takes over the registrar account, they can redirect your site and your email. Put two-step verification on it, keep the contact email current so renewal notices arrive, and switch on auto-renew. Write down who holds the login. For many tradespeople the answer is “the lad who built it in 2017”, which is a risk in itself.

7. Back up properly, and test it

Backups are what turn a disaster into an irritating week. The NCSC advises small organisations to keep backups separate from the systems they protect and to test that you can restore them. The ICO’s ransomware guidance makes a related point: a backup that sits on the same network or account an attacker has reached may be encrypted or deleted along with everything else, so backups need to be part of your risk assessment.

In practice:

• Take daily backups of the site and database.
• Store at least one copy off the server, and ideally one offline or in a separate account.
• Restore a copy to a test location every quarter to prove it works.
• Keep a note of where backups live and who can get to them.

8. Choose hosting as a security decision

Plugins cannot make up for a poor host. Look for a host that applies server patches, runs a firewall and malware scanning, takes daily backups and gives you a clear way to contact support. Shared hosting can be fine for a small brochure site, but ask how accounts are isolated from each other. If your site is built on a platform where the provider handles hosting, security patches and updates for you, ask for that in writing.

9. Secure forms and data

If your site collects names, phone numbers, addresses or photos of customers’ homes, keep that data to what you need. Do not email it around unprotected, and do not store it in the website itself longer than necessary. Add spam protection to your forms, such as a honeypot field or CAPTCHA, and make sure your privacy notice says what you do with the data.

10. Write a breach plan

Decide in advance what you will do if the site is compromised. The NCSC says organisations should plan for resilience, including keeping recovery plans on paper, and BBC News reported in 2025 that government wrote to chief executives urging them to hold physical copies of their response plans. One page is enough:

1. Who to call first (your web provider, then your host).
2. Where the backups are and how to restore them.
3. How to change every password quickly.
4. Who decides whether personal data is affected.
5. How you will tell customers, and what you will say.

Print it and keep it somewhere that does not depend on your website or email working.

What UK GDPR expects of you

If your website handles personal data, UK GDPR requires you to process it securely using appropriate technical measures. The ICO’s guidance is clear that personal data breaches must be reported to the ICO within 72 hours of becoming aware of them, where feasible, unless the breach is unlikely to risk people’s rights and freedoms. Whether a particular incident counts is a judgement call. If you are unsure, read the ICO’s guidance and speak to the ICO or a data protection adviser. Do not wait to find out.

The same ICO guidance also expects you to keep a record of breaches, even those you decide not to report. Your breach plan is a good place to keep that log.

WordPress-specific checks

WordPress powers a huge share of small business sites, which makes it a popular target for automated attacks. Beyond the general list:

• Only install plugins you can see are actively maintained, with a recent update date.
• Avoid “nulled” or pirated premium themes and plugins, which are a classic way to get malware onto a site.
• Disable the built-in file editor in the dashboard if you do not use it.
• Use a security plugin for scanning and login protection if you like, but treat it as an extra layer, not a fix for a neglected site.
• Check the user list monthly for accounts you do not recognise.

What to ask your web provider

If someone else looks after your site, a short conversation will tell you a lot. Ask them:

Vague answers are a signal in themselves.

Our perspective: security is a routine, not a feature

We build and manage websites for trade businesses, and the pattern we see is consistent. Few sites are hacked by anything clever. They fall over because nobody owned the boring jobs: updates, renewals, backups, who still has a login.

That is why our sites come with monthly management rather than a hand-off and a goodbye. Hosting, security checks and regular updates sit with us, so you are not trying to remember them between jobs. We also keep sites simple. Fewer plugins and fewer moving parts mean fewer things that can break or be exploited, and a site that is quicker to fix when something does go wrong.

Our advice to any tradesperson is to decide who is responsible for the website’s health, write their name down, and ask them to show you the evidence every month. We can only promise to do the work carefully. Nobody honest can promise a site will never be attacked.

— Trey

How we handle it at TK Marketing

If you would rather not run this checklist yourself, our monthly website management covers hosting, updates and security checks as part of the plan. The published options are:

We also offer a WordPress website at £599 one-off, and an AI-assisted framework website at £35 per month or £350 per year. If you only need your Google profile looked after, monthly management starts from £20 per month. For a wider look at what a trade site costs and what is and is not included, see our guide to web design costs for UK trades, or have a look at our website services.

Security does not stop at the website. A hijacked Google Business Profile can cost you calls just as quickly, so it is worth running through our 90-day Google Business Profile audit too.

A 30-minute quarterly routine

Put this in your diary every three months:

1. Visit your site on http:// and confirm it redirects to https://.
2. Run the NCSC scan and note anything flagged.
3. Check the user list and remove anyone who should not be there.
4. Confirm updates have been applied and read the log.
5. Ask for a test restore from a backup, or do one yourself.
6. Check domain and hosting renewal dates.
7. Review your paper breach plan and update phone numbers.

If you want a broader view beyond the website, the NCSC’s free Cyber Action Toolkit gives small businesses short, practical actions to work through.

FAQ

How often should I check my website’s security?

A quick look every quarter suits most small business sites, with updates and backups running automatically in between. Check sooner after any change, such as a new plugin, a new staff member with access, or a change of host. If someone else manages the site, ask them for a monthly summary.

Is a small business website really at risk of being hacked?

Yes, because most attacks are automated and look for weaknesses, not particular targets. The NCSC reports that about half of UK small businesses have a cyber incident each year. Basic habits such as updates, strong logins and tested backups reduce the risk, but they cannot remove it.

Do I need a security plugin on WordPress?

Not necessarily. A plugin can add useful scanning and login protection, but it will not rescue a site with an old theme, weak passwords or poor hosting. Fix the foundations first: updates, deleting unused plugins, two-step verification and backups.

What should I do if my website is hacked?

Contact your web provider and host straight away, then restore from a clean backup and change every password. If customer personal data may have been exposed, the ICO says you may need to report it within 72 hours, so read its guidance or seek advice from a data protection professional the same day.

Is HTTPS enough to keep my site secure?

No. HTTPS protects data in transit between the visitor and your site, but it does nothing about outdated plugins, stolen passwords or a compromised host. It is the first item on the list, not the whole list.

Sources

• Small organisations guide to cyber security, NCSC
• Backing up your data, NCSC
• Check your cyber security (active cyber defence), NCSC
• Check your cyber security service, NCSC
• Web Check service description, NCSC
• Cyber Action Toolkit, NCSC
• Personal data breaches: a guide, ICO
• Ransomware and data protection compliance, ICO
• Password manager provider fined by ICO
• Have plans on paper in case of cyber-attack, BBC News
• WordPress Security Guide for UK-Based SMBs

Recommended

• UK Web Design Costs for Trades: What £599 Does Not Cover