DEV Community: Daniel Fenton

How Do I Know If My Website Is Secure? A Non-Technical Checklist

Daniel Fenton — Tue, 04 Aug 2026 11:58:36 +0000

You don't need to be a web developer to know whether your website is safe. A few quick checks — most of which take under two minutes — will tell you whether your site is protecting your customers or quietly putting them at risk.

This guide walks you through exactly what to look for, in plain English, no technical background required.

Why website security matters for small businesses

A secure website protects your customers' data, keeps your business out of trouble with UK law, and stops hackers from using your site to spread harm. Under the UK GDPR (General Data Protection Regulation — the law that governs how businesses handle personal data), you have a legal duty to keep customer information safe. A compromised website can mean fines, reputational damage, and losing the trust of the very people you rely on.

The good news is that most small business websites share the same handful of security problems, and most of them are straightforward to fix.

The non-technical security checklist

1. Does your website address start with HTTPS?

If your website address starts with https:// rather than http://, it has an SSL certificate — a digital padlock that encrypts (scrambles) the information travelling between your site and your visitors. This is the most basic security check there is.

Open your website in a browser and look at the address bar. You should see a padlock icon and the letters https.

⚠️ If your site still shows http:// without the S, browsers like Chrome will label it "Not Secure" to every visitor. That puts people off, and it may affect how Google ranks you. Talk to your web host straight away — most include free SSL certificates as standard.

The SSL/TLS standard your certificate should meet is maintained by the Internet Engineering Task Force. Their guidance (RFC 8446) defines modern TLS 1.3 as the current secure standard. Your web host should be using this automatically.

2. When did you last update your website software?

Outdated software is the single most common way small business websites get hacked. If your site runs on a platform like WordPress, Wix, or Squarespace, there is software running underneath it that needs to stay current.

Here is what to check:

Your platform itself — Is it running the latest version?
Plugins or apps (small add-ons that give your site extra features) — Are they all up to date?
Your theme (the design template your site uses) — When was it last updated?

WordPress
Log in to your WordPress dashboard. If you see a number in a red circle next to "Updates" in the left menu, you have updates waiting. Click it and install everything. Do this at least once a month.

Wix or Squarespace
These platforms handle core software updates automatically. However, check any third-party apps you have added through their app marketplaces, as those may need manual attention.

3. Do you have a backup of your website?

A backup is a saved copy of your entire website that can be restored if something goes wrong. Think of it like the insurance policy you hope you never need.

Ask your web host or developer:

How often is the site backed up?
Where are the backups stored?
How quickly could the site be restored if it was hacked?

You want daily backups stored somewhere separate from your main website. If your host stores backups on the same server as your site, a hack could destroy both at once.

4. Are your passwords strong and unique?

Weak passwords are still behind a huge number of website breaches. The National Cyber Security Centre (NCSC) — the UK government body responsible for cybersecurity guidance — recommends using three random words strung together as a strong, memorable password.

Check the following:

Account	What to check
Website admin login	Is the username something obvious like "admin"? Change it.
Hosting account	Does it use a unique password not used anywhere else?
Domain registrar	Is two-factor authentication (a second login step) turned on?
Email account linked to your site	Is this protected with a strong password?

💡 A password manager like Bitwarden (free) or 1Password stores all your passwords securely so you only need to remember one. The NCSC recommends this approach for small businesses.

5. Is your contact form protected against spam bots?

Spam bots (automated programs that fill in web forms) can flood your inbox with junk, or worse, use your contact form to send spam to others. This can get your website blacklisted by email providers.

Look for a CAPTCHA on any forms on your site — a small puzzle or tick-box that confirms the person filling in the form is human. Google's reCAPTCHA is the most widely used free option. If your forms have no protection at all, ask your web developer or platform support to add it.

6. Does your website have an SSL certificate that is actually valid?

Having HTTPS is a good start, but SSL certificates expire — usually every year or every 90 days depending on the type. An expired certificate will cause browsers to show visitors a large red warning page telling them the site is not safe.

To check your certificate:

Visit your website in Chrome or Firefox.
Click the padlock icon in the address bar.
Click "Connection is secure" and then "Certificate is valid".
Check the expiry date shown.

If it expires within the next 30 days, contact your host. Many hosts renew certificates automatically, but it is worth confirming this is set up correctly.

7. Are you using a reputable, up-to-date hosting provider?

Your web host — the company whose computers your website lives on — is responsible for a large part of your site's security. A cheap or poorly maintained host can leave you exposed no matter how carefully you manage your own site.

Look for a host that offers automatic malware scanning, a firewall (a security barrier that blocks suspicious traffic), and free SSL certificates. Regular automatic backups matter too. If you store customer data, UK or EU-based servers are worth seeking out for UK GDPR compliance.

Well-regarded UK hosting providers include SiteGround, Krystal, and 20i, though the right choice depends on your platform and budget.

8. Have you ever checked your site for malware?

Malware can sit silently on a website for months, stealing customer data or redirecting visitors to harmful sites, without the owner ever knowing. Google's Safe Browsing technology flags millions of unsafe pages every day — and if your site gets flagged, it will disappear from search results.

You can check whether Google has flagged your site by visiting the Google Transparency Report at transparencyreport.google.com/safe-browsing/search and entering your web address.

For a deeper scan, tools like Sucuri SiteCheck (free) will crawl your site and report any known malware or blacklisting issues.

If your site is struggling to appear in Google at all, it may be worth reading our guide on why your website might not be showing up on Google — a security issue can be one of the causes.

9. Is your website admin area protected?

The admin area is the behind-the-scenes section where you log in to make changes to your site. If it is easy to find and has no extra protection, it is an easy target.

A few simple steps make a real difference. Change the default login URL if your platform allows it — for WordPress, the default /wp-admin address is well known to hackers. Enable two-factor authentication (2FA) on your admin login, which means a hacker would need your password and your phone to get in. Also limit the number of login attempts allowed before the account is temporarily locked.

WordPress
Plugins like Wordfence or Solid Security (both have free versions) handle login protection, 2FA, and login attempt limits in one place. Install one and follow the setup wizard.

10. Do you know who has access to your website?

Over time, websites accumulate extra user accounts — old employees, previous developers, freelancers who helped with a project years ago. Every unused account is a potential weak point.

Log in to your website admin area and check the list of user accounts. Remove anyone who no longer needs access. For people who do still need access, make sure they only have the level of permission they actually need.

Your security checklist at a glance

Check	What to look for	Priority
HTTPS	Padlock and https:// in address bar	High
Software updates	Platform, plugins, and theme all current	High
Backups	Daily backups stored off-site	High
Strong passwords	Unique, complex, manager recommended	High
Form protection	CAPTCHA on all contact forms	Medium
Valid SSL certificate	Not expired or expiring soon	High
Good hosting	Malware scanning, firewall, backups	High
Malware scan	No flags on Google Safe Browsing	High
Admin area protection	2FA and login limits in place	Medium
User access audit	Only active, trusted accounts remain	Medium

What to do if you find a problem

Don't panic. Most of these issues have straightforward fixes, and your web host's support team should be your first call. If you use a developer, send them this checklist and ask them to go through it with you.

If you want a quick overall picture of how your site is doing, you can run a free check at website.auditmy.co.uk — it takes under a minute and gives you a report you can share with your developer or host.

It is also worth connecting your site to Google Search Console, a free tool from Google that shows you how your site is performing in search and flags any security issues Google detects. Our guide on what Google Search Console is and how to use it walks you through the setup in plain English.

💡 Once your security is in order, take a look at the other basics that affect how your site performs online. Our guide on what meta descriptions are and why they matter is a good next step for any small business owner who wants their site to work harder for them.

The bottom line

Website security is not a one-time job. It is more like locking up your shop at night — something you do regularly, not just once. Set a reminder to run through this checklist every three months, keep your software updated, and make sure someone is keeping an eye on your backups.

You do not need to understand the technical details to keep your site secure. You just need to ask the right questions and act on what you find.

What Is DKIM and How Do I Set It Up? A Plain-English Guide for UK Small Businesses

Daniel Fenton — Tue, 28 Jul 2026 14:25:58 +0000

What Is DKIM?

DKIM (DomainKeys Identified Mail) is a security standard that proves an email genuinely came from your business and hasn't been tampered with in transit. Think of it as a wax seal on a letter: it tells the recipient that the message is authentic and hasn't been opened or altered along the way.

Without DKIM, anyone can send an email that appears to come from your domain (your web address, such as yourshop.co.uk). Fraudsters do this constantly to scam your customers, and it can push your legitimate emails into spam folders too.

Why should a small business owner care?

If you send emails from your own domain, whether that's order confirmations, newsletters, or quotes, DKIM affects whether those emails actually land in inboxes.

Here is what happens without it:

Your emails are more likely to be flagged as spam
Scammers can impersonate your business by spoofing (faking) your email address
Your customers could receive fraudulent emails that look like they came from you
Your sender reputation (how trustworthy email providers think you are) gradually declines

Setting up DKIM takes around 15 to 30 minutes if you know where to look. This guide walks you through it step by step.

DKIM works best as part of a trio of email security settings. The other two are SPF and DMARC. You do not need all three today, but DKIM is a very solid place to start.

How does DKIM actually work?

DKIM uses two matching keys (codes), one private and one public, in a system defined by internet standard RFC 6376.

Your private key lives on your email server and signs every outgoing email invisibly
Your public key is published in your domain's DNS records (DNS stands for Domain Name System, which is the internet's address book that points people to your website and email)
When an email arrives, the recipient's email server checks your public DNS record to verify the signature matches

If the signature checks out, the email passes. If it doesn't match, or there's no signature at all, the email looks suspicious.

You never actually see any of this happening. It runs behind the scenes automatically, once you've set it up.

Before you start: what you will need

What you need	Where to find it
Access to your domain's DNS settings	Your domain registrar (e.g. 123 Reg, GoDaddy, Namecheap)
Access to your email platform	e.g. Google Workspace, Microsoft 365, Mailchimp
About 20 to 30 minutes	A quiet moment and a cup of tea

💡 Not sure who manages your domain? Search your inbox for the original registration confirmation email, or check your bank statements for a payment to a domain provider.

Step 1: Generate your DKIM keys

Your DKIM keys are generated by your email sending platform, not by you manually. Most major platforms do this automatically and simply ask you to copy a DNS record and paste it into your domain settings.

Here is how to find your DKIM key in the most common platforms:

Google Workspace
Go to your Google Admin console at admin.google.com. Click Apps, then Google Workspace, then Gmail. Select Authenticate Email and choose your domain. Click Generate New Record and leave the settings on their defaults. Google will show you a DNS record to copy.

Microsoft 365
Log in to the Microsoft 365 Defender portal at security.microsoft.com. Go to Email and Collaboration, then Policies and Rules, then Threat Policies. Select DKIM and choose your domain. Toggle DKIM on. Microsoft will display two CNAME records (a type of DNS entry that points one address to another) for you to add to your DNS.

Mailchimp
Mailchimp sets up DKIM automatically when you authenticate your domain. Go to Account, then Domains, and follow the steps to verify your sending domain. Mailchimp will give you DNS records to add.

Zoho Mail
Go to the Zoho Mail Admin Console, click Domains, and select your domain. Choose Email Authentication, then DKIM. Click Add Selector, accept the default settings, and Zoho will generate the DNS record for you.

Step 2: Add the DNS record to your domain

Once you have your DKIM record from your email platform, you need to add it to your domain's DNS settings. This is where most people feel a little nervous, but it's simpler than it sounds.

Log in to your domain registrar (where you bought your domain)
Find the DNS management area, sometimes called DNS Zone, DNS Settings, or Manage DNS
Add a new TXT record (a text-based DNS entry used for verification purposes)
In the Name or Host field, paste the selector your email platform gave you (it usually looks something like google._domainkey)
In the Value or Content field, paste the long string of characters your email platform generated
Set the TTL (Time to Live, which controls how quickly the change spreads across the internet) to the default, usually 3600 or Auto
Save the record

⚠️ DNS records are case-sensitive. Copy and paste them exactly as shown by your email platform. Do not retype them manually, as a single wrong character will cause the whole thing to fail.

Step 3: Verify that DKIM is working

DNS changes can take anywhere from a few minutes to 48 hours to spread across the internet, though most take effect within an hour or two.

Once you've waited a short while, go back to your email platform and look for a Check Status or Verify button. Most platforms will confirm whether DKIM is now active.

You can also test it for free using these tools:

MXToolbox DKIM Lookup at mxtoolbox.com/dkim.aspx
Mail Tester at mail-tester.com, which lets you send a test email and get a full report
Google Admin Toolbox at toolbox.googleapps.com

Common problems and how to fix them

Problem	Likely cause	Fix
DKIM shows as not found	DNS has not propagated yet	Wait an hour and check again
DKIM verification fails	Record copied incorrectly	Delete the record and re-paste it exactly
Multiple DKIM records conflicting	Old records left behind	Delete outdated DKIM records for the same selector
Platform says DKIM is active but emails still go to spam	Other issues at play	Check SPF and DMARC settings too

If your emails are still ending up in spam folders after setting up DKIM, other factors may be involved. Our guide on why emails go to spam covers the full picture in plain English.

What about DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the third piece of the email security puzzle, after SPF and DKIM. It tells receiving email servers what to do if an email fails your DKIM or SPF checks, for example, reject it or send it to spam.

You don't need to set up DMARC today, but once your DKIM is working, it's the natural next step. Our guide on what DMARC is and how to set it up walks you through it clearly.

A quick summary

DKIM proves your emails are genuinely from you
It works using a digital signature checked automatically by receiving email servers
You generate the key in your email platform, then add one DNS record to your domain
The whole process takes under 30 minutes
It helps your emails reach inboxes instead of spam folders
It protects your customers from scammers pretending to be you

Check your current email setup for free

If you're not sure whether DKIM, SPF, or DMARC are already set up on your domain, or set up correctly, you can run a free check at website.auditmy.co.uk. It checks your domain and gives you a plain-English summary of what's in place and what's missing, with no technical knowledge required.

💡 Once DKIM is live, take five minutes to check your SPF record too. The two work together, and having both in place significantly strengthens your email security. Our guide on SPF and stopping emails going to spam is a good next read.

Sources: RFC 6376 (DKIM Signatures), Google Workspace Admin Help, Microsoft 365 Defender documentation, NCSC Email Security Guidance for small organisations.

What Is SPF and How Do I Stop Emails Going to Spam?

Daniel Fenton — Tue, 21 Jul 2026 09:57:20 +0000

What is SPF?

SPF stands for Sender Policy Framework. It's a simple technical rule you add to your domain (your website address, like yourbakery.co.uk) that tells email providers which computers are allowed to send email on your behalf.

Think of it like a staff list on your front door. When an email arrives claiming to be from you, the receiving email provider checks your SPF record — a short line of text stored in your domain settings — to see if the sender is on the list. If they're not, the email gets treated with suspicion and often lands in spam.

Why does this actually matter for my business?

If you send invoices, booking confirmations, or newsletters, whether those emails actually reach people depends partly on whether you have SPF set up correctly.

Without SPF, your emails look suspicious to providers like Gmail and Outlook, even if you wrote every word yourself. The inbox providers have no way to verify the email genuinely came from you.

This is not just a problem for big companies. Small businesses sending from platforms like Mailchimp, Squarespace, or even a basic cPanel (the control panel many web hosts use to manage emails) are affected just as much.

How does SPF actually work?

SPF works by checking a public record stored in your domain's DNS (Domain Name System, the internet's address book that links your domain name to the correct computers).

Here is the basic process, step by step:

You send an email from your business address, say hello@yourbakery.co.uk.
The recipient's email provider looks up your SPF record in your DNS settings.
It checks whether the computer that sent the email is listed as authorised in that record.
If it is authorised, the email is allowed through normally.
If it is not listed, the email may be marked as spam, rejected entirely, or flagged as a potential forgery.

The SPF record itself looks something like this:

v=spf1 include:mailgun.org include:_spf.google.com ~all

You don't need to write that from scratch. Your email platform will give you the exact text to copy and paste.

What happens if I do not have SPF set up?

SPF is not legally required, but without it you are making your emails much harder to deliver reliably.

Here is what can go wrong:

Emails land in spam. This is the most common symptom. Your customers may never even see your messages.
Scammers can impersonate you. Without SPF, it is much easier for fraudsters to send emails pretending to be from your address. This can damage your reputation with customers.
Email providers penalise you over time. Repeated delivery failures can reduce your sender reputation (a score email providers give your domain based on how your emails behave), making future emails even less likely to arrive.

For more on the wider causes of poor email delivery, have a read of our guide on why your emails are going to spam.

How do I check if SPF is already set up?

You don't need to log in to anything complicated. There are free tools that will check your domain in seconds.

Two reliable options:

MXToolbox SPF checker (mxtoolbox.com/spf.aspx) is a free, widely used tool. Type in your domain and it will tell you whether an SPF record exists and whether it looks correct.
Google Admin Toolbox (toolbox.googleapps.com) is Google's own checker and is particularly useful if you use Google Workspace (Google's paid suite of business tools including Gmail, Docs, and Drive) for your email.

Type your domain into either tool and look for a line starting with v=spf1. If you see one, you have an SPF record. If you see nothing, or an error, you need to add one.

How do I set up SPF?

SPF is set up by adding a TXT record (a plain text entry) to your domain's DNS settings. This is usually done through your domain registrar (the company you bought your domain from, such as GoDaddy, Namecheap, 123 Reg, or similar).

The exact text you need depends on where you send your emails from. Your email platform will tell you what to copy and paste.

Google Workspace
Go to your domain registrar's DNS settings. Add a new TXT record. In the value field, paste: v=spf1 include:_spf.google.com ~all
Save and allow up to 48 hours for it to take effect.

Microsoft 365
Add a TXT record to your DNS with this value: v=spf1 include:spf.protection.outlook.com ~all
Microsoft's own setup guide walks you through this step by step in their admin centre.

Mailchimp
Mailchimp handles sending from its own servers, so you need to add their authorised servers to your SPF record. Mailchimp's help pages give you the exact include: value to add.
If you also send from Google or another provider, you can combine them: v=spf1 include:servers.mcsv.net include:_spf.google.com ~all

cPanel Hosting (most small business hosts)
Log in to your hosting control panel. Go to Zone Editor or DNS Zone Manager. Add a TXT record for your domain with the value your email provider specifies. If in doubt, ask your host's support team. They do this every day.

⚠️ You can only have one SPF record per domain. If you use multiple email services — Google Workspace for your main email and Mailchimp for newsletters, say — you must combine them into a single SPF record. Two separate SPF records breaks SPF entirely and can make things worse than having none at all.

The difference between SPF, DKIM, and DMARC

You may have heard these three terms mentioned together. They work as a set, and understanding how they relate to each other helps.

Term	What It Does	Analogy
SPF	Confirms which servers are allowed to send email for your domain	The staff list on the door
DKIM	Adds a digital signature to each email to prove it has not been tampered with	A wax seal on a letter
DMARC	Sets the rules for what happens if SPF or DKIM checks fail	The manager who decides what to do if the seal is broken

SPF is the right place to start, but if you want proper protection, all three should be set up. Our guide on what DMARC is and how to set it up covers that next step in plain English.

Common SPF mistakes to avoid

Having two SPF records. As mentioned above, this breaks things. Combine everything into one record.
Forgetting to include all your sending services. If you send from your website contact form as well as Gmail, both need to be listed.
Using -all instead of ~all at the end. The ~all ending (called a soft fail) is more forgiving and recommended for most small businesses. The -all ending (hard fail) can cause legitimate emails to be rejected if anything is slightly misconfigured.
Not checking after making changes. Use MXToolbox again after any updates to confirm everything looks correct.

A quick summary

To pull it all together:

SPF is a record in your DNS that tells email providers who is allowed to send email from your domain.
Without it, your emails are more likely to land in spam or be used by fraudsters.
You set it up by adding a TXT record to your domain's DNS, using the text your email provider gives you.
You can only have one SPF record, so combine all your services into a single line.
SPF works best alongside DKIM and DMARC.

If you are not sure where things stand with your domain right now, you can run a free check at website.auditmy.co.uk. It checks your SPF record along with a range of other factors that affect how your business appears online, and it takes about thirty seconds.

💡 Once your SPF is sorted, the next step is setting up DMARC, which gives you control over what happens when someone tries to fake emails from your domain. Read our guide on what DMARC is and why it matters to see how straightforward it can be.

SPF is defined in RFC 7208, published by the Internet Engineering Task Force (IETF), the body responsible for core internet standards. Google's email sender guidelines, updated in 2024, now require SPF authentication for anyone sending significant volumes of email to Gmail accounts.

Can AI Chatbots See Your Website? What is llms.txt and Do You Need One

Daniel Fenton — Sat, 18 Jul 2026 13:05:15 +0000

AI is changing how people find businesses online

Not long ago, finding a local bakery or a reliable plumber meant typing something into Google and clicking a link. That still happens millions of times a day. But something else is happening alongside it.

More and more people are asking AI assistants like ChatGPT, Perplexity, or Google's Gemini their questions directly. Instead of a list of links, they get a written answer. And that answer often pulls information from websites just like yours.

The question is: can these AI tools actually read your website properly? And should you do anything about it?

What does an AI chatbot actually do?

Think of an AI chatbot as a very fast researcher. It has been trained on enormous amounts of text from across the internet, including business websites, blogs, and news articles. When someone asks it a question, it draws on everything it has read to give an answer.

Some AI tools also browse the web in real time, pulling fresh information from websites as people ask questions. Either way, your website content could end up shaping the answers these tools give.

If your website is clear and well-written, an AI tool is more likely to represent your business accurately. If it is confusing or poorly structured, the AI might get things wrong, or ignore you entirely.

So what is llms.txt?

LLM stands for Large Language Model, the technical name for the type of AI behind tools like ChatGPT. An LLM is a sophisticated programme that has learned to understand and generate text by processing vast quantities of written material.

llms.txt is a simple text file you can add to your website. It sits quietly in the background and acts as a plain-English guide for AI tools, telling them what your website is about, which pages matter most, and how to understand your content.

Think of it like leaving a note on the door for a delivery driver. The driver could eventually figure out where to leave the parcel, but a clear note makes everything faster and more accurate.

llms.txt is not an official standard backed by a big organisation like Google. A developer called Jeremy Howard proposed it in September 2024 and it has been gaining traction since. Not every AI tool looks for it yet, but a growing number do.

How is this different from robots.txt?

You may have heard of robots.txt, a file that tells search engines like Google which pages on your site they can and cannot look at. llms.txt serves a different purpose.

robots.txt is about permission. It says "you can look here, but not there."

llms.txt is about clarity. It says "here is what we do, here are our most important pages, and here is how to understand us."

The two files sit happily side by side on your website. They are not in competition.

What does an llms.txt file actually look like?

This is where people often expect something complicated. In reality, it is just a plain text file with a few simple sections.

A basic llms.txt for a bakery in Leeds might look something like this:

# Greenfield's Bakery

> A family-run bakery in Leeds specialising in sourdough, celebration cakes, and gluten-free pastries. We offer local delivery and wedding cake consultations.

## Key Pages

- [About Us](https://www.greenfieldsbakery.co.uk/about)
- [Our Menu](https://www.greenfieldsbakery.co.uk/menu)
- [Wedding Cakes](https://www.greenfieldsbakery.co.uk/wedding-cakes)
- [Order Online](https://www.greenfieldsbakery.co.uk/order)
- [Contact](https://www.greenfieldsbakery.co.uk/contact)

That is genuinely it. A short description of your business and links to your most important pages. Some businesses add more detail, but even something this simple is better than nothing.

Do you actually need one?

Honest answer: right now, it is not essential. Most small businesses in the UK do not have one, and they are not immediately losing customers because of it.

But the way people search for businesses is shifting. AI-powered answers are becoming part of everyday life. Getting ahead of this now, while it is still straightforward, makes more sense than scrambling to catch up later.

A basic llms.txt file takes about twenty minutes to create. It costs nothing. And it puts a clear, accurate description of your business in front of the AI tools that growing numbers of your potential customers are using.

If you are already thinking about your wider online visibility, it is also worth reading our guide on why your website might not be showing up on Google, since many of the same principles apply.

How to create your llms.txt file

Here is a straightforward process, even if you have never done anything like this before.

Step 1: Open a plain text editor
On a Windows PC, use Notepad. On a Mac, use TextEdit (make sure it is set to plain text, not rich text).

Step 2: Write a short description of your business
One or two sentences. What do you do, where are you based, what makes you different?

Step 3: List your most important pages
Your homepage, your services or products page, your contact page, and anything else a potential customer would want to see.

Step 4: Save the file as llms.txt
Exactly that name, all lowercase.

Step 5: Upload it to your website's root folder
This is the main folder where your website lives. If your site is at www.yourbusiness.co.uk, the file should end up at www.yourbusiness.co.uk/llms.txt

How you upload it depends on your website platform.

WordPress
Log into your hosting control panel (often called cPanel) and use the File Manager to upload llms.txt to the public_html folder. Alternatively, ask your web host to do it for you.

Squarespace
Squarespace does not currently allow direct file uploads to the root folder. You may need to speak to a developer or use a workaround via Squarespace's custom code settings. This is one situation where a quick email to your web designer is the easiest path.

Wix
Wix also has limitations here. The simplest approach is to contact Wix support or use a Wix app designed for custom file hosting. Check the Wix app market for "file hosting" options.

Shopify
In your Shopify admin, go to Online Store, then Themes, then Actions, and select Edit Code. You can add files here. If this feels daunting, your theme developer or a Shopify expert can do it in minutes.

💡 Once your file is live, check it by typing your website address followed by /llms.txt into a browser. If you can see the text you wrote, it is working. While you are at it, setting up Google Search Console gives you a much clearer picture of how both search engines and AI crawlers are interacting with your site.

What about AI tools that scrape without asking?

Some AI companies send automated programmes called crawlers or bots to read websites without any invitation. You can block specific AI crawlers using your robots.txt file if you would rather they did not use your content.

Common AI crawler names you might see in your server logs include GPTBot (OpenAI), ClaudeBot (Anthropic), and PerplexityBot. Adding a "Disallow" line to your robots.txt for any of these will stop them reading your site.

⚠️ Blocking AI crawlers means those tools will not include your business in their answers. For most small businesses, being visible is more valuable than blocking access. Think carefully before you block anyone.

The bigger picture

llms.txt is a small thing. But it reflects a genuine shift in how people find information online. Search engines are embedding AI into their results. Standalone AI assistants are fielding questions that used to go to Google. Voice assistants are getting smarter.

The businesses that do well in this environment will be the ones with websites that are clear, accurate, and easy to understand, whether the reader is a human, a search engine spider, or an AI language model.

If you are not sure where your website stands right now, you can run a free check at website.auditmy.co.uk. It gives you a straightforward report on what is working and what might need attention, with no technical knowledge required to understand the results.

Adding an llms.txt file is one small, free step in the right direction. Twenty minutes of your time now could mean your bakery, your shop, or your service business gets mentioned accurately the next time someone asks an AI assistant for a recommendation in your area.

That seems like a reasonable investment.

How to Get Your Website on Google: A Plain-English Guide for UK Small Businesses

Daniel Fenton — Sat, 30 May 2026 12:41:59 +0000

You've built your website, paid someone to set it up, or spent a weekend doing it yourself. But when you type your business name into Google, nothing comes up. Or worse, a competitor appears where you should be.

This happens to thousands of small businesses across the UK. The good news is that getting onto Google is not mysterious, and most of it is free. Let's go through it properly.

First, does Google even know your website exists?

Google works by sending out automated software called crawlers (think of them as little robots that wander around the internet reading web pages and reporting back). If a crawler has never visited your site, Google has no idea it exists.

The fastest way to check is simple. Open Google and type site:yourwebsiteaddress.co.uk replacing that with your actual address. If results appear, Google knows about you. If you see nothing, you have some work to do.

Tell Google your website exists

The most reliable way to do this is through a free tool called Google Search Console, a dashboard Google gives you to see how your site is performing in search results and to send Google your web pages directly.

Setting it up takes about ten minutes. Go to search.google.com/search-console, sign in with a Google account, and add your website. Google will ask you to verify (prove) that you actually own the site. The easiest method is usually adding a small piece of code to your site, or connecting through Google Analytics if you already use that.

Our guide on what Google Search Console is and how to use it walks you through the whole setup if you want the full picture.

Submit a sitemap

Once you're inside Google Search Console, you want to submit something called a sitemap. That's an XML file, which is just a list in a specific format, that tells Google every page on your website and how they connect.

Most website platforms create this automatically. Look for a URL ending in /sitemap.xml by typing your web address followed by that. For example: www.yourbakery.co.uk/sitemap.xml. If a page of text appears, that is your sitemap. Copy that URL and paste it into the Sitemaps section of Google Search Console.

WordPress
Install a free plugin called Yoast SEO or Rank Math. Both automatically create and update your sitemap. Once installed, find the sitemap link inside the plugin settings and submit it to Google Search Console.

Wix
Wix creates a sitemap for you automatically. Go to Google Search Console, click Sitemaps, and enter sitemap.xml as the path. Wix handles the rest.

Squarespace
Squarespace generates a sitemap automatically at yourdomain.com/sitemap.xml. Submit that URL directly in Google Search Console under the Sitemaps section.

Make sure Google can actually read your pages

Here's something that catches a lot of people out. Sometimes a website is accidentally set to "disallow crawling", a setting that tells Google's robots to go away and not read anything. This can get switched on during a website build and never turned off.

Inside Google Search Console, use the URL Inspection tool to test your homepage. It will tell you whether Google can reach and read that page. If it says the page is blocked, that is likely your problem.

⚠️ If your web developer built your site and handed it over, ask them specifically whether crawling is enabled. It is a common oversight that can keep you invisible on Google for months.

Give Google something worth showing

Getting into Google's index, the giant database of web pages Google stores and searches through, is only step one. The next question is where you appear when someone searches for what you offer.

Google ranks pages based on how relevant and useful they are. If your bakery website just has your name and a phone number, Google has very little to work with. You need to give it content.

Each page should clearly describe what you do and where you do it. Your homepage might say something like "Freshly baked sourdough and celebration cakes in Norwich, delivered Tuesday to Saturday." That tells Google exactly what you offer and who you serve.

💡 Think about the phrases your actual customers use. They probably search "birthday cake Norwich" not "artisan confectionery Norfolk." Write like they talk.

Local search is your best friend

If you run a physical shop or serve a specific area, local SEO (search engine optimisation, meaning the work you do to help your site appear in relevant searches) is where you will see the quickest results.

Set up a free Google Business Profile at business.google.com. This is the box that appears on the right side of Google when someone searches for a local business, showing your address, hours, photos, and reviews. You do not need to rank highly in regular search results to appear there. It runs alongside your website.

Fill in every section of your Google Business Profile completely. Add real photos. Ask happy customers to leave reviews. This alone can put you in front of local people who are ready to buy.

Sort out the basics your site needs

Google takes a few technical factors seriously when deciding whether to show your site. None of them are complicated.

Your site needs to be secure. Look at your web address. It should start with https:// not http://. The "s" stands for secure, and Google actively prefers secure sites. If yours starts with http, speak to your web host, the company that stores your website, about getting an SSL certificate, a small file that enables that secure connection. Most hosts provide these free now.

Your site needs to work on a mobile phone. More than half of all searches in the UK happen on a phone. If your website looks broken or tiny on a mobile screen, Google notices and ranks you lower as a result.

Your site needs to load quickly. A page that takes more than three or four seconds to appear loses visitors, and Google knows this. Large uncompressed images are the most common cause of slow pages for small business sites.

If you are not sure whether your site has these issues, run a free check at website.auditmy.co.uk. It checks these fundamentals in seconds and gives you a plain-English report on what needs attention.

💡 If your site keeps appearing and disappearing from Google results, or you have done all of the above and still cannot be found, read our guide on why your website might not be showing up on Google for a deeper look at what might be going wrong.

Be patient, but not passive

Once you have done the above, Google typically takes anywhere from a few days to a few weeks to index your pages. New websites can occasionally take longer.

Do not sit and wait without checking. Go back into Google Search Console every week or two. Look at the Coverage report to see which pages have been indexed and whether any errors have come up. If a page shows an error, click on it to see what the problem is.

Building up your presence in search results is gradual. A three-year-old website with good content and a few links pointing to it from other sites will outrank a brand new one almost every time. Start the work now so that in six months you are in a much better position.

A quick checklist to get started

Type site:yourdomain.co.uk into Google to see if you are indexed
Set up Google Search Console and verify your site
Find and submit your sitemap
Set up or claim your Google Business Profile
Check your site starts with https://
Test your site on a mobile phone
Make sure each page clearly describes what you do and where

None of this requires technical expertise. It requires a couple of hours and a bit of persistence. The businesses showing up at the top of Google are not necessarily the best at what they do. They are the ones who made sure Google could find them and understand them.

Now you know how to do the same.

How to Write a Robots.txt File for Your Small Business Website

Daniel Fenton — Sun, 17 May 2026 10:00:22 +0000

What on earth is a robots.txt file?

Imagine you run a bakery and a journalist turns up wanting to photograph everything. You might say, "Yes, photograph the front of house, but please don't go into the kitchen or the staff room." A robots.txt file does exactly that for your website. It is a small text file that tells search engine robots [automated programmes that crawl and read websites] which pages they are allowed to look at and which they should leave alone.

Every time Google, Bing, or any other search engine wants to index [add to its list of searchable pages] your website, its robot visits your robots.txt file first. It reads the instructions, then behaves accordingly.

Robots.txt is not a security measure. It is a polite set of instructions, not a lock on the door. A well-behaved search engine will follow it. A badly behaved one might not. Never rely on robots.txt to hide sensitive information.

Why does this matter to your business?

If your robots.txt file is missing, wrong, or set to block everything, Google simply cannot index your website properly. Fewer people find you when they search for what you sell.

This is one of the most common reasons a small business website disappears from search results without any obvious explanation. If you have ever wondered why your website is not showing up on Google, a misconfigured robots.txt file is often the culprit.

Getting this right takes about ten minutes once you understand what you are doing.

Where does the file live?

Your robots.txt file must always sit at the root [the top level, main address] of your website. That means it should be accessible at a web address that looks like this:

https://www.yourbusiness.co.uk/robots.txt

Try that now with your own web address. Type your website address into a browser, add /robots.txt at the end, and press enter. If you see a page of text, you already have one. If you see a blank page or an error, you need to create one.

What does a robots.txt file actually look like?

Here is the simplest possible robots.txt file, the one that most small business websites need:

User-agent: *
Disallow:

That is genuinely it. Two lines. Here is what each part means.

User-agent: refers to which robot you are talking to. The asterisk [the star symbol] means "everyone" or "all robots." So User-agent: * means "this instruction applies to all search engine robots."

Disallow: tells the robot which pages it cannot visit. When you leave it blank after the colon, it means "there is nothing off limits, you can look at everything." This is the right setting for most small business websites.

💡 If your robots.txt file currently contains Disallow: / with a forward slash after the colon, you have accidentally blocked every search engine from your entire website. Change it to Disallow: with nothing after the colon as soon as possible.

When would you want to block something?

There are a few cases where telling robots to stay away from certain pages actually makes sense.

Login pages, thank-you pages that appear after a purchase, and internal search results pages are not worth Google indexing. They do not help customers find you, and a site cluttered with low-quality indexed pages can work against you in search rankings.

Here is how you would block specific pages:

User-agent: *
Disallow: /thank-you/
Disallow: /login/
Disallow: /search-results/

Each Disallow: line blocks one folder or page. The forward slash before the page name matters. Do not leave it out.

⚠️ Never block your CSS [the files that control how your website looks] or JavaScript [the files that make your website interactive] files. Google needs to see those to understand your site properly. An older piece of advice used to suggest blocking them, but that guidance is well out of date.

A note about sitemaps

A sitemap [a file that lists all the pages on your website, a bit like a contents page] is a separate file from robots.txt, but the two work well together. You can point robots towards your sitemap by adding one line at the bottom of your robots.txt file:

User-agent: *
Disallow:

Sitemap: https://www.yourbusiness.co.uk/sitemap.xml

This helps search engines find all your pages more quickly. If you are not sure whether you have a sitemap, try visiting your web address followed by /sitemap.xml and see what comes up.

Once you have your sitemap sorted, submitting it directly through Google Search Console is a smart next step. It is a free tool from Google that shows you how your site is performing in search results.

How to actually create or edit the file

This depends on what platform your website is built on. For most popular platforms, you either do not need to touch robots.txt manually, or there is a simple settings panel that handles it for you.

WordPress
If you use an SEO plugin like Yoast or Rank Math, go to the plugin settings and look for a section called "Tools" or "Edit robots.txt." You can edit the file directly from there without touching any code. If you do not have an SEO plugin, you can use a free plugin called "WP Robots Txt" to manage it.

Wix
Wix generates a robots.txt file for you automatically. You can customise it by going to your Wix dashboard, clicking Settings, then SEO Tools, then Robots.txt. Be careful here as the interface can be a little confusing. If in doubt, leave the default settings in place.

Squarespace
Squarespace does not let you fully edit robots.txt on most plans. It generates one automatically. On higher-tier plans you have more control. If you are on a basic plan and need changes made, contact Squarespace support directly.

Shopify
Shopify controls your robots.txt file for you and does a reasonable job by default. You can edit it using Liquid [Shopify's own template language] in your theme files, but this is best left to a developer unless you are confident. For most small shops, the default is absolutely fine.

Custom or bespoke website
If your website was built by a developer, ask them to check the robots.txt file for you. Share this article with them and ask them to confirm the file matches what is described here. You should not have to pay much, if anything, for a quick check like this.

The most common mistakes to avoid

Blocking the whole website with Disallow: / is the biggest one, and it happens more often than you would think. It is usually left over from when the site was being built and the developer did not want Google indexing a half-finished website. They forgot to change it before launch.

The second most common mistake is having no robots.txt file at all. Search engines will still crawl your site, but you lose the ability to guide them, and some robots may slow down when they cannot find the file they expect.

Typos and formatting errors are the third problem. Robots.txt is very literal. A space in the wrong place or a missing forward slash can make an instruction meaningless or cause unintended blocking.

💡 After making any changes to your robots.txt file, run a free check at website.auditmy.co.uk to see whether search engines can still reach your key pages. It takes about thirty seconds and flags the most common problems in plain English. You might also want to read our guide on why your website might not be showing up on Google while you are at it.

A simple robots.txt file for most small businesses

If you want a safe, sensible starting point that works for the vast majority of small business websites, here it is:

User-agent: *
Disallow:

Sitemap: https://www.yourbusiness.co.uk/sitemap.xml

Replace the web address in the sitemap line with your actual address. Save the file as a plain text file called robots.txt with no other words in the name. Upload it to the top level of your website. That is all there is to it.

This file says: every robot is welcome, nothing is off limits, and here is where to find the full list of pages. Simple, honest, and effective.

One last thing

Robots.txt sits quietly in the background doing its job when it is right, and causing real problems when it is wrong. Most small business owners never think about it, which is exactly why checking it is such a useful quick win.

Ten minutes today could be the difference between your website appearing in search results and sitting invisible while your competitors take the customers you should be getting.

What Are Meta Descriptions and Why Do They Matter for Your Website?

Daniel Fenton — Fri, 15 May 2026 11:15:50 +0000

What are meta descriptions and why do they matter?

If you have ever searched for something on Google and read the short snippet of text under a website's title before deciding whether to click, you have already encountered a meta description. That little paragraph is doing a surprisingly important job.

Understanding what it does, and how to write a good one, can genuinely improve how many people choose to visit your website. You do not need to be technical to get this right.

So what exactly is a meta description?

A meta description is a short piece of text that sits in the background code of your webpage. You cannot see it on the page itself, but Google reads it and often uses it as the summary text shown beneath your link in search results.

Think of it like the blurb on the back of a book. The title might catch someone's eye, but the blurb is what convinces them to open the cover. Your meta description does the same job.

Here is a real-world example. Imagine you run a bakery in Bristol called Flour & Stone. Your homepage might appear in Google like this:

Flour & Stone Bakery, Bristol
Award-winning sourdough and freshly baked pastries made every morning in Clifton. Order online or visit us on Whiteladies Road.

That second line? That is the meta description at work.

Does Google always use what you write?

Not always. Google will sometimes rewrite your meta description if it decides something else on your page is more relevant to what someone searched for.

That said, writing a good one still matters. When Google uses it, you want it to be clear, accurate, and persuasive. When Google rewrites it, having well-written page content to draw from gives you a better chance of ending up with something decent.

Google rewrites meta descriptions roughly 60 to 70 per cent of the time, according to various studies. That is not a reason to skip writing them. It is a reason to make sure your page content is just as clear and well-written as your description.

Why do meta descriptions matter for your business?

Here is the honest answer: meta descriptions do not directly affect how high you rank in Google. Google has confirmed this. Writing a brilliant meta description will not push you to the top of the results.

What they do affect is whether someone clicks your link once you appear in those results. This is called your click-through rate [CTR, meaning the percentage of people who see your link and actually click it].

If your description is vague, dull, or missing entirely, people will scroll past you even if you are sitting at the top of the page. If it speaks directly to what someone is looking for, they are far more likely to choose you over a competitor.

For a small business, every click matters. You are not competing with a marketing budget the size of a department store's. A well-written meta description is a free, practical way to make your listing work harder.

What happens if you do not write one?

If you leave the meta description blank, Google will pull a random chunk of text from your page to use instead. This is almost never ideal. It might grab your navigation menu, a cookie policy notice, or some other text that makes no sense out of context.

This happens to more small business websites than you might think, and it makes listings look unprofessional and unhelpful. It is entirely avoidable.

If you are not sure whether your pages have meta descriptions, or whether they are any good, a free check at website.auditmy.co.uk will flag missing or poorly written ones across your site in seconds.

How long should a meta description be?

Aim for between 140 and 160 characters [a character is a single letter, space, number, or punctuation mark]. Google typically cuts off anything longer than that with an ellipsis, meaning your carefully written sentence gets chopped mid-thought.

Shorter is fine too, but anything under about 100 characters might feel a little thin. Think of it as roughly two short sentences.

💡 If you are unsure how long your description is, type it into a free character counter tool online. Search for "character counter" and paste your text in. You will see the number instantly.

How to write a good one

You do not need to be a copywriter. You just need to answer two questions clearly: what is this page about, and what is in it for the person reading?

Here are a few simple principles to follow:

Be specific. "Welcome to our website" tells nobody anything. "Fresh sourdough bread baked from scratch every morning in Bristol, available to order online" tells them exactly what they need to know.

Match the page. Your meta description should describe what is actually on that specific page, not your whole business. Your About page description should be different from your Shop page description.

Include a natural nudge. Phrases like "order online", "book a free consultation", or "see our full menu" give people a reason to click. Keep it natural though. Nobody wants to feel pressured by a sentence.

Use words your customers use. If people search for "gluten-free birthday cakes Bristol" and you offer that, say so plainly. Do not swap plain language for something that sounds impressive but means nothing.

Where do you actually add a meta description?

This depends on what platform your website is built on. On most popular platforms, you do not need to touch any code.

WordPress with Yoast SEO or Rank Math
Open the page or post you want to edit. Scroll down below the main content area and look for the SEO plugin section. You will see a field labelled "Meta description" or "SEO description". Type your text in there and save the page.

Squarespace
Open the page editor and click the settings cog icon for the page. Look for the "SEO" tab at the top of the settings panel. You will find a "SEO Description" field there. Fill it in and save.

Shopify
Go to your Online Store, then Pages or Products depending on which page you are editing. Scroll to the bottom of the edit screen and look for the "Search engine listing" section. Click "Edit website SEO" to expand it. The description field is there.

Wix
In the Wix editor, click on the page you want to edit, then go to Page Settings, followed by the SEO tab. You will find the meta description field there. Fill it in and click Done.

If your website was built by a developer and you are not sure how to access this, drop them a quick message and ask them to add or update the meta descriptions on your key pages. It is a small task and should not take long.

Which pages should you prioritise?

If you have a large website, do not feel you need to fix everything at once. Start with the pages that matter most to your business.

Your homepage is the obvious first stop. Then think about any page you actively want customers to find: a menu page, a services page, a contact page, your most important product pages.

If you have a blog or news section with lots of older posts, those can wait. Focus where the impact will be felt first.

A quick word on duplicate descriptions

One mistake that catches a lot of small business owners out is using the same meta description across multiple pages. Maybe someone copied and pasted the homepage description everywhere when the site was built.

Google does not penalise you for this the way it might for duplicated page content, but it is still a wasted opportunity. Each page is a chance to tell a different, specific story to a potential customer.

If you have been wondering why your website is not showing up on Google, duplicate or missing meta descriptions are often one of several small issues combining to hold a site back.

Keeping an eye on how things are going

Once you have written your meta descriptions, it is worth checking how your pages perform in search results over time. Google Search Console [a free tool from Google that shows you how your site appears in search] lets you see which pages people are clicking on and which are being ignored.

If a page is showing up in results but getting very few clicks, that is often a sign the meta description is not doing its job. Our guide on what Google Search Console is and how to use it walks you through getting set up without any technical knowledge required.

💡 Once you have sorted your meta descriptions, run a free check at website.auditmy.co.uk to see if there are any other quick wins on your site. It checks for missing descriptions, slow loading times, and a handful of other common issues that affect small business websites.

The bottom line

Meta descriptions are not magic, and they will not fix a broken website on their own. But they are one of the simplest, most overlooked improvements a small business can make.

They cost nothing. They take ten minutes per page once you know where to look. And they make the difference between someone scrolling past your listing and someone clicking through to buy from you.

That is a pretty good return for a couple of sentences.

What is a bounce rate and why does it matter?

Daniel Fenton — Fri, 15 May 2026 08:03:34 +0000

What is a bounce rate and why does it matter?

You have probably heard someone mention "bounce rate" at some point. Maybe from a web designer, a marketing contact, or a passing comment in a Facebook group for small business owners. It sounds technical, but the idea behind it is actually quite simple.

This guide explains what it means, why it matters for your business, and what you can do about it without needing to be a tech expert.

So what actually is a bounce rate?

Imagine someone walks into your bakery, glances around for three seconds, and walks straight back out without saying a word. They did not look at your cakes, they did not ask about your sourdough, and they certainly did not buy anything.

That is a bounce. On a website, a bounce happens when someone lands on a page and then leaves without clicking on anything else or visiting any other page on your site.

Your bounce rate is simply the percentage of visitors who do this. If 100 people visit your website and 60 of them leave immediately without exploring further, your bounce rate is 60%.

Is a high bounce rate bad?

Not always, and this is where people get confused. Context matters enormously.

If you run a bakery and your website has a page showing your opening hours, someone might visit that page, find the information they needed, and leave happy. That is technically a bounce, but it is a successful one.

However, if someone lands on your homepage, seems interested in your wedding cakes, but leaves without clicking to find out more, that is a problem. You had their attention and lost it.

A bounce rate between 40% and 60% is considered fairly typical for most small business websites. Above 70% is worth investigating. Below 30% can sometimes indicate a tracking error rather than exceptional performance.

Why does it matter for your business?

There are two main reasons to care about your bounce rate.

The obvious one: a high bounce rate usually means people are not finding what they came for. Fewer enquiries, fewer sales, fewer bookings. Money is walking out the door.

The less obvious one involves search engines. Google pays attention to how people behave on your site. If visitors consistently arrive and leave immediately, Google may take that as a sign your site is not very useful for that search. Over time, this can affect where you appear in results. If you are already puzzled about why your site is not ranking well, our guide on why your website is not showing up on Google covers the fuller picture.

What causes a high bounce rate?

There are several common culprits, and most of them are fixable.

Your page loads too slowly. People are impatient online. If your page takes more than three seconds to load, a significant chunk of visitors will give up and go elsewhere. This is one of the most common causes for small business websites.

Your page does not match what they expected. If someone searches for "gluten-free birthday cakes in Bristol" and lands on your generic homepage rather than a page about your gluten-free range, they may assume you do not offer what they want and leave.

Your site is hard to read on a phone. More than half of web browsing in the UK now happens on mobile devices. If your site looks jumbled on a small screen, visitors will not stick around.

Your content does not answer their question quickly enough. People scan websites rather than read them. If your most important information is buried halfway down the page, many visitors will not wait to find it.

Your site looks untrustworthy. An outdated design, a missing security certificate (the padlock symbol in the browser address bar), or broken images can all make visitors uneasy enough to leave.

How do you check your bounce rate?

The most common way is through Google Analytics, a free tool from Google that tracks visitor behaviour on your website. If you have not set it up yet, it is worth doing.

Once you are in Google Analytics, look for the "Engagement" section if you are using the newer version (called GA4), or the "Audience Overview" in the older version (called Universal Analytics). Your bounce rate will be displayed there.

💡 If you have never looked at your website data before, Google Search Console is another free tool worth setting up alongside Analytics. It shows you what search terms people are using to find your site, which can help you understand whether visitors are arriving with the right expectations.

If all of that sounds like too much to deal with right now, do not worry. You can get a useful snapshot of how your site is performing without logging into anything.

What can you do to improve your bounce rate?

Here are the most effective changes you can make, starting with the ones that tend to have the biggest impact.

Speed up your website. This is the single most reliable way to reduce your bounce rate. Talk to your web developer about image compression (making your photo files smaller without losing quality), caching (storing parts of your site so they load faster for returning visitors), and your hosting package.

WordPress

If your site runs on WordPress, a free plugin like WP Super Cache can make a noticeable difference to your page speed. Go to Plugins, search for it, install it, and tick "Caching On" in the settings.

Squarespace or Wix

These platforms manage a lot of the speed side of things for you, but you can still help by keeping your images reasonably sized before you upload them. Free tools like Squoosh.app let you compress images in seconds before uploading.

Make your most important information obvious and fast to find. Your phone number, location, opening hours, or key services should be near the top of the page, not hidden at the bottom.

Make sure your site works well on a mobile. Pull your website up on your own phone right now. Is the text readable without zooming in? Are the buttons easy to tap? If not, raise it with your web designer.

Match your pages to your visitors' expectations. If you are running adverts or have specific pages aimed at particular searches, make sure those pages actually deliver what the visitor was looking for. A page about your wedding cakes should talk about wedding cakes, not your whole product range.

Add a clear next step on every page. Give visitors somewhere obvious to go. A button that says "See our full menu", "Get a free quote" or "Call us today" encourages people to keep exploring rather than drifting away.

A quick reality check

Improving your bounce rate will not happen overnight, and chasing a perfect number is not the point. The goal is to make sure people who are genuinely interested in what you offer actually stay long enough to find it.

Even small improvements can make a real difference. Dropping your bounce rate from 70% to 55% on a page that gets 500 visitors a month means roughly 75 more people exploring your site every month. For a small business, that adds up.

💡 If you are not sure where your site currently stands, you can run a free check at website.auditmy.co.uk. It takes less than a minute and gives you a plain-English summary of what is working and what needs attention, including how your site performs on speed and mobile usability.

The short version

A bounce rate tells you how many visitors are leaving your website without engaging with it. A high bounce rate usually means something is getting in the way, whether that is slow loading, confusing content, or a page that does not match what the visitor expected.

The most common causes are fixable, and fixing them tends to help your search rankings and your sales at the same time. Start with page speed and mobile usability, make your key information easy to find, and go from there.

What is HTTPS and Why Does Your Website Need It

Daniel Fenton — Thu, 14 May 2026 23:01:59 +0000

You have probably noticed that little padlock icon in your browser when you visit a website. Maybe you have wondered what it means, or whether your own website has one. This guide explains what that padlock is, why it matters, and what you should do if your site is missing it.

What HTTPS actually means

HTTPS stands for HyperText Transfer Protocol Secure. Do not worry about remembering that. All you need to know is that it is the secure version of the system your website uses to send information back and forth between your site and your visitors.

Think of it like this. When someone fills in a contact form on your website, that information travels across the internet to reach you. Without HTTPS, it travels in plain text, a bit like sending a postcard. Anyone who intercepts it along the way can read it. With HTTPS, that same information is scrambled (encrypted, meaning turned into unreadable code) before it leaves the visitor's browser, so only your website can unscramble it at the other end.

The padlock icon simply tells your visitor that this encryption is in place and that they are connected to your real website, not a fake copy.

What is an SSL certificate?

HTTPS is made possible by something called an SSL certificate (Secure Sockets Layer, a technology that creates a secure connection). This is a small digital file that lives on your web server (the computer that hosts your website) and proves two things: that your website is who it claims to be, and that data passing between the site and the visitor is encrypted.

Your hosting provider (the company you pay to keep your website live) usually installs this certificate. Many providers include one for free these days, so there is a good chance you already have the option available without any extra cost.

Note: Having an SSL certificate installed does not automatically mean your whole website is running on HTTPS. Some sites have the certificate but still serve certain pages over the old, unencrypted connection. Check every page, not just your homepage.

Why your small business website needs it

Your visitors expect it

Browsers like Google Chrome and Firefox actively warn visitors when a site does not have HTTPS. Instead of a padlock, they show a "Not Secure" warning in the address bar. For a bakery, a plumber, or an online shop, that warning is the digital equivalent of a cracked window and a broken front door. Even if a visitor is not quite sure what it means, it makes them uneasy.

Research consistently shows that visitors leave sites with security warnings rather than risk entering their details. Those are potential customers walking away before they have even read your menu or looked at your prices.

Google takes it seriously

Google has confirmed that HTTPS is a ranking signal, meaning a factor that influences how high your website appears in search results. If your site does not have HTTPS and a competitor's site does, that competitor has an advantage in Google searches, all else being equal.

It is not the biggest ranking factor going, but for a small local business where every edge counts, it is a straightforward win that costs very little to sort out.

It protects your customers and your reputation

If your website has a contact form, a booking form, or anywhere customers type in personal details, you have a responsibility to handle that information safely. HTTPS is a basic part of meeting it.

Under UK data protection law (GDPR, the General Data Protection Regulation, which sets rules on how businesses collect and handle personal data), you are expected to take appropriate technical measures to protect personal data. Running a contact form over an unencrypted connection is the kind of thing that could raise eyebrows if something went wrong and you were ever asked to account for your practices.

Warning: If you take any payments directly on your website, HTTPS is not optional. It is an absolute requirement. Any reputable payment provider will refuse to operate on a non-HTTPS site, and rightly so.

How to check whether your site has HTTPS

The quickest way is to type your web address into a browser and look at the very start of the address. If it begins with https:// and shows a padlock icon, you are in good shape. If it begins with http:// (no S) or shows a warning, you have work to do.

Check a few pages beyond your homepage too. Look at your contact page, your about page, and any page with a form on it. Some sites have a mixed setup where the homepage is secure but other pages are not.

While you are at it, take a look at your security headers as well. They are another layer of protection that most small business sites are missing entirely.

How to get HTTPS set up

For most small business websites, this is neither expensive nor particularly complicated. Here is what to do depending on your setup.

:::card WordPress (hosted with a provider like SiteGround, Kinsta, or similar)
Log into your hosting account's control panel. Look for an option called SSL or Let's Encrypt (a free SSL provider). Enable it. Then install a free plugin called Really Simple SSL, which automatically redirects all your pages to the secure version. Done.
:::

:::card Squarespace
Squarespace handles SSL automatically for all sites on paid plans. Go to Settings, then Domains, and make sure the HTTPS option is switched on. If your domain is connected but not showing HTTPS, check that your domain is fully verified in the Domains panel.
:::

:::card Wix
Wix enables SSL automatically for all sites. If for any reason yours is not showing the padlock, go to your Wix dashboard, click Settings, then SSL, and toggle it on. If the option is greyed out, contact Wix support directly.
:::

:::card Shopify
Shopify includes SSL for all stores by default. If your custom domain is not showing HTTPS, the issue is usually with how the domain is connected. Check your domain settings in the Online Store section and follow Shopify's domain setup instructions for your domain registrar (the company where you bought your web address).
:::

:::card Custom or bespoke website
Contact your web developer or hosting provider and ask them to install an SSL certificate and redirect all HTTP traffic to HTTPS. If they use cPanel (a common hosting control panel), they can often do this in minutes using a free Let's Encrypt certificate. If they want to charge you a large fee for this, it is worth getting a second opinion.
:::

Note: After switching to HTTPS, check that old HTTP addresses automatically redirect to the new HTTPS versions. If both versions of your site are accessible at once, this can cause problems with how Google indexes (lists and ranks) your pages.

One more thing worth knowing

HTTPS protects the connection between your site and your visitors. It does not make your website invincible. It is one layer of protection, not the whole picture. Phishing sites (fake websites designed to trick people) can have HTTPS too, so the padlock means the connection is secure, not necessarily that the site itself is trustworthy.

Other security measures are worth having alongside HTTPS. If you use email with your business domain, for example, look into DMARC, which helps prevent criminals from sending emails that appear to come from your address.

Security is not a single thing you fix once and forget. It is a set of sensible habits and basic protections. HTTPS is simply where the list starts.

Check your own site for free

If you are not sure whether your site has HTTPS set up correctly, or you want to see what else might need attention, run a free check at website.auditmy.co.uk. It takes about thirty seconds and gives you a plain-English summary of what is working and what is not, with no technical knowledge required to understand the results.

Tip: While you are looking at your site's security, check your security headers too. Most small business sites score zero on their first check, and fixing them is often simpler than you might expect.

The short version

HTTPS encrypts the information that passes between your website and your visitors. It shows as a padlock in the browser. Without it, visitors see a "Not Secure" warning, Google gives you a slight disadvantage in search results, and you are not handling your customers' data properly. For most websites, it is free to set up and takes less than an hour. There is really no good reason to leave it switched off.

My Test Webhook Guide

Daniel Fenton — Sun, 03 May 2026 19:38:17 +0000

This is a test

Testing the Dev.to integration from Make.com!