Why bother, when nobody is targeting you
The most common reason small business owners skip this is a reasonable one. Nobody is sitting in a darkened room picking on a roofing firm in Louth. That is true, and it is also beside the point, because almost none of this is personal. It is automated. Software crawls the internet looking for domains with a particular weakness, and it neither knows nor cares what your business does.
The government's Cyber Security Breaches Survey for 2025/2026, published in April 2026, found that 43% of UK businesses identified a breach or attack in the previous twelve months, which works out at roughly 612,000 businesses. Among the smallest firms, the ones with fewer than ten people, it was 42%. Phishing was far and away the most common form, hitting 38% of businesses.
That last figure is the one worth sitting with. The typical attack on a small business is not someone breaking into your website. It is someone using your name to fool a customer or an employee. Several items on this list are about making that harder.
1. The padlock, and whether it is actually doing anything
Type your web address into a browser starting with http rather than https, and see what happens. It should send you straight to the secure version. If it loads happily without the padlock, or shows a "Not Secure" warning, that is the first job, and most hosting providers now include the certificate free.
Half-done is the common state here. The certificate exists, but the insecure version still loads alongside it, so some of your visitors and some search engines see an unprotected site. The fix is a redirect at the hosting or DNS level, and it usually takes minutes.
2, 3 and 4. The three records that stop people emailing as you
SPF, DKIM and DMARC are public records attached to your domain. Together they let every receiving inbox check whether a message claiming to be from you genuinely came from you, and tell it what to do when the answer is no. Without them, anyone can put your address in the from line of an invoice, which is exactly the phishing problem those survey figures describe.
These are three separate items rather than one because they fail separately, and having one or two of them is common and misleading. We have written both a plain-English explanation of why criminals can send email as your business and a fuller guide to DMARC, including why leaving it on monitoring mode is not protection.
If you only do one thing from this entire list, do this one. It protects your customers rather than your website, and the damage it prevents is the kind that costs you a relationship rather than an afternoon.
5. Who can log in, and whether they should still be able to
Every website has accounts behind it: the site itself, the hosting, the domain registrar, the email. Most small businesses accumulate more of these than they realise, and they rarely get tidied. A designer who built the site three years ago, a former employee, an agency you stopped using.
Go through each one and remove anybody who no longer needs access. Then turn on two-factor authentication wherever it is offered, starting with the email account that can reset all the others, because that account is the master key to everything else you own online.
6. Backups you have actually seen work
Ask your host two questions: are backups running, and how would I get the site back from one. A surprising number of small business sites are backed up in a way nobody has ever tested, which is a plan rather than a safety net.
The useful version keeps copies somewhere other than the server itself, retains them for long enough to notice a problem that took a fortnight to surface, and can be restored without a support ticket and a three-day wait.
7. Updates, which is the boring one that matters most
The National Cyber Security Centre is consistent on this: unpatched software is one of the leading routes into small organisations. Automated scanning looks specifically for known weaknesses in out-of-date platforms and plugins, which is why sites nobody has ever heard of still get compromised.
If your site runs on a platform with plugins, somebody needs to be updating them on a schedule. If nobody is, that is not a small gap. It is the single most likely way your site ends up serving something you did not put there.
8. Who owns your domain name
Log in to the registrar and check that the registrant is you or your company, not your web designer, not an agency, and not somebody's personal account from years ago. This is not a security control in the technical sense, but it decides whether you can act at all when something goes wrong.
While you are there, make sure the renewal date is not a surprise and the contact address is one somebody still reads. Domains lapse quietly, and a lapsed domain takes the website and the email with it.
9. What your contact form does with what people type into it
If your site collects enquiries, it is handling personal data, and UK GDPR applies to a two-person firm exactly as it does to a large one. In practice that means a privacy policy that reflects what you actually do, form submissions travelling over HTTPS, and not leaving enquiries sitting in a shared inbox everyone can read forever.
None of this needs a lawyer for a typical small business site. It needs somebody to have thought about it once and written it down honestly.
Where to start
Items one to four are the ones with real leverage, and all four are visible from outside your business, which means they are visible to everyone else too. The free security check reads your domain's public records and grades exactly those in plain English. It is passive, nothing touches your site or your inbox, and there is no sign-up.
If the report comes back with gaps you would rather not spend a weekend on, that is a large part of what I do. The services page covers how it works, or get in touch and I will tell you which item on this list to fix first for your particular setup.