You don't need to be a web developer to know whether your website is safe. A few quick checks — most of which take under two minutes — will tell you whether your site is protecting your customers or quietly putting them at risk.
This guide walks you through exactly what to look for, in plain English, no technical background required.
Why website security matters for small businesses
A secure website protects your customers' data, keeps your business out of trouble with UK law, and stops hackers from using your site to spread harm. Under the UK GDPR (General Data Protection Regulation — the law that governs how businesses handle personal data), you have a legal duty to keep customer information safe. A compromised website can mean fines, reputational damage, and losing the trust of the very people you rely on.
The good news is that most small business websites share the same handful of security problems, and most of them are straightforward to fix.
The non-technical security checklist
1. Does your website address start with HTTPS?
If your website address starts with https:// rather than http://, it has an SSL certificate — a digital padlock that encrypts (scrambles) the information travelling between your site and your visitors. This is the most basic security check there is.
Open your website in a browser and look at the address bar. You should see a padlock icon and the letters https.
⚠️ If your site still shows http:// without the S, browsers like Chrome will label it "Not Secure" to every visitor. That puts people off, and it may affect how Google ranks you. Talk to your web host straight away — most include free SSL certificates as standard.
The SSL/TLS standard your certificate should meet is maintained by the Internet Engineering Task Force. Their guidance (RFC 8446) defines modern TLS 1.3 as the current secure standard. Your web host should be using this automatically.
2. When did you last update your website software?
Outdated software is the single most common way small business websites get hacked. If your site runs on a platform like WordPress, Wix, or Squarespace, there is software running underneath it that needs to stay current.
Here is what to check:
- Your platform itself — Is it running the latest version?
- Plugins or apps (small add-ons that give your site extra features) — Are they all up to date?
- Your theme (the design template your site uses) — When was it last updated?
WordPress
Log in to your WordPress dashboard. If you see a number in a red circle next to "Updates" in the left menu, you have updates waiting. Click it and install everything. Do this at least once a month.
Wix or Squarespace
These platforms handle core software updates automatically. However, check any third-party apps you have added through their app marketplaces, as those may need manual attention.
3. Do you have a backup of your website?
A backup is a saved copy of your entire website that can be restored if something goes wrong. Think of it like the insurance policy you hope you never need.
Ask your web host or developer:
- How often is the site backed up?
- Where are the backups stored?
- How quickly could the site be restored if it was hacked?
You want daily backups stored somewhere separate from your main website. If your host stores backups on the same server as your site, a hack could destroy both at once.
4. Are your passwords strong and unique?
Weak passwords are still behind a huge number of website breaches. The National Cyber Security Centre (NCSC) — the UK government body responsible for cybersecurity guidance — recommends using three random words strung together as a strong, memorable password.
Check the following:
| Account | What to check |
|---|---|
| Website admin login | Is the username something obvious like "admin"? Change it. |
| Hosting account | Does it use a unique password not used anywhere else? |
| Domain registrar | Is two-factor authentication (a second login step) turned on? |
| Email account linked to your site | Is this protected with a strong password? |
💡 A password manager like Bitwarden (free) or 1Password stores all your passwords securely so you only need to remember one. The NCSC recommends this approach for small businesses.
5. Is your contact form protected against spam bots?
Spam bots (automated programs that fill in web forms) can flood your inbox with junk, or worse, use your contact form to send spam to others. This can get your website blacklisted by email providers.
Look for a CAPTCHA on any forms on your site — a small puzzle or tick-box that confirms the person filling in the form is human. Google's reCAPTCHA is the most widely used free option. If your forms have no protection at all, ask your web developer or platform support to add it.
6. Does your website have an SSL certificate that is actually valid?
Having HTTPS is a good start, but SSL certificates expire — usually every year or every 90 days depending on the type. An expired certificate will cause browsers to show visitors a large red warning page telling them the site is not safe.
To check your certificate:
- Visit your website in Chrome or Firefox.
- Click the padlock icon in the address bar.
- Click "Connection is secure" and then "Certificate is valid".
- Check the expiry date shown.
If it expires within the next 30 days, contact your host. Many hosts renew certificates automatically, but it is worth confirming this is set up correctly.
7. Are you using a reputable, up-to-date hosting provider?
Your web host — the company whose computers your website lives on — is responsible for a large part of your site's security. A cheap or poorly maintained host can leave you exposed no matter how carefully you manage your own site.
Look for a host that offers automatic malware scanning, a firewall (a security barrier that blocks suspicious traffic), and free SSL certificates. Regular automatic backups matter too. If you store customer data, UK or EU-based servers are worth seeking out for UK GDPR compliance.
Well-regarded UK hosting providers include SiteGround, Krystal, and 20i, though the right choice depends on your platform and budget.
8. Have you ever checked your site for malware?
Malware can sit silently on a website for months, stealing customer data or redirecting visitors to harmful sites, without the owner ever knowing. Google's Safe Browsing technology flags millions of unsafe pages every day — and if your site gets flagged, it will disappear from search results.
You can check whether Google has flagged your site by visiting the Google Transparency Report at transparencyreport.google.com/safe-browsing/search and entering your web address.
For a deeper scan, tools like Sucuri SiteCheck (free) will crawl your site and report any known malware or blacklisting issues.
If your site is struggling to appear in Google at all, it may be worth reading our guide on why your website might not be showing up on Google — a security issue can be one of the causes.
9. Is your website admin area protected?
The admin area is the behind-the-scenes section where you log in to make changes to your site. If it is easy to find and has no extra protection, it is an easy target.
A few simple steps make a real difference. Change the default login URL if your platform allows it — for WordPress, the default /wp-admin address is well known to hackers. Enable two-factor authentication (2FA) on your admin login, which means a hacker would need your password and your phone to get in. Also limit the number of login attempts allowed before the account is temporarily locked.
WordPress
Plugins like Wordfence or Solid Security (both have free versions) handle login protection, 2FA, and login attempt limits in one place. Install one and follow the setup wizard.
10. Do you know who has access to your website?
Over time, websites accumulate extra user accounts — old employees, previous developers, freelancers who helped with a project years ago. Every unused account is a potential weak point.
Log in to your website admin area and check the list of user accounts. Remove anyone who no longer needs access. For people who do still need access, make sure they only have the level of permission they actually need.
Your security checklist at a glance
| Check | What to look for | Priority |
|---|---|---|
| HTTPS | Padlock and https:// in address bar | High |
| Software updates | Platform, plugins, and theme all current | High |
| Backups | Daily backups stored off-site | High |
| Strong passwords | Unique, complex, manager recommended | High |
| Form protection | CAPTCHA on all contact forms | Medium |
| Valid SSL certificate | Not expired or expiring soon | High |
| Good hosting | Malware scanning, firewall, backups | High |
| Malware scan | No flags on Google Safe Browsing | High |
| Admin area protection | 2FA and login limits in place | Medium |
| User access audit | Only active, trusted accounts remain | Medium |
What to do if you find a problem
Don't panic. Most of these issues have straightforward fixes, and your web host's support team should be your first call. If you use a developer, send them this checklist and ask them to go through it with you.
If you want a quick overall picture of how your site is doing, you can run a free check at website.auditmy.co.uk — it takes under a minute and gives you a report you can share with your developer or host.
It is also worth connecting your site to Google Search Console, a free tool from Google that shows you how your site is performing in search and flags any security issues Google detects. Our guide on what Google Search Console is and how to use it walks you through the setup in plain English.
💡 Once your security is in order, take a look at the other basics that affect how your site performs online. Our guide on what meta descriptions are and why they matter is a good next step for any small business owner who wants their site to work harder for them.
The bottom line
Website security is not a one-time job. It is more like locking up your shop at night — something you do regularly, not just once. Set a reminder to run through this checklist every three months, keep your software updated, and make sure someone is keeping an eye on your backups.
You do not need to understand the technical details to keep your site secure. You just need to ask the right questions and act on what you find.
Top comments (0)