Website security checklist for UK small businesses

Start with the basics

Most website compromises aren’t sophisticated. They come from out-of-date software, reused passwords and forgotten admin accounts. Work through this list once, then review it every few months.

Software and plugins

• Turn on automatic updates for your CMS, theme and plugins where possible
• Remove plugins and themes you don’t use
• Only install plugins from reputable, actively maintained sources

Logins and accounts

• Use a password manager and unique passwords for every admin account
• Turn on two-factor authentication for your website, hosting, domain registrar and email
• Remove accounts for former staff and agencies
• Give people the lowest level of access they need

Your domain and email

• Lock your domain at the registrar and keep contact details current
• Set up SPF, DKIM and DMARC so criminals can’t easily send email as you
• Know who controls your DNS

HTTPS and headers

• Serve every page over HTTPS and redirect HTTP to HTTPS
• Add basic security headers (see our security headers guide)

Forms and customer data

• Protect contact and sign-up forms from spam with rate limits or a challenge
• Collect only the data you need and know where it’s stored
• Check your privacy notice matches what you actually do (UK GDPR)

Backups and recovery

• Take automatic backups stored away from your hosting account
• Test restoring a backup at least once
• Write down who to call if the site is defaced or taken offline

Then get it tested

A checklist covers the common gaps; a penetration test finds the ones specific to your site. If you’d like an independent view, request our complimentary AI pentest.