No Worry Websites & AI Automations logo
Book a call
← Back to the blog

Website security for small business: your 2026 action plan

Six actions stop the vast majority of attacks on small business websites, and most take under 30 minutes to complete. Here is your immediate to-do list:

  • Install or verify your SSL/TLS certificate (5 min — free via Let’s Encrypt)
  • Enable multi-factor authentication (MFA) on all admin accounts (10 min — free)
  • Run all platform, plugin, and theme updates (30 min — free)
  • Set up automated daily backups stored off-site (30 min — £0–£5/month)
  • Audit and strengthen all passwords using a password manager (30 min — free tier available)
  • Run the NCSC Cyber Action Toolkit to get a personalised plan (15 min — free)

The ICO and NCSC both confirm these controls address the most common attack vectors. If you only do one thing today, run the Cyber Action Toolkit — it generates a personalised checklist in under 15 minutes and costs nothing.

Table of Contents

Why does website security matter so much for UK small businesses?

The short answer: you are a target, and the cost of getting it wrong is rising fast.

According to the Cyber Security Breaches Survey 2025/2026, 43% of UK businesses experienced a cyber security breach or attack in the preceding 12 months. For small businesses, the rate was 46%; micro-businesses, 42%. These are not edge cases.

43% of UK businesses reported a cyber security breach or attack in the past year (Cyber Security Breaches Survey 2025/2026, GOV.UK).

The financial impact is climbing too. AMVIA’s 2026 research puts the average cost of a cyber breach for a UK SME at £6,400, a 52% increase from the 2024 average. For a small business with tight margins, that figure alone justifies every item on the checklist above.

Beyond the direct cost, a breach that exposes customer data triggers a legal obligation. Under UK GDPR, you must report a notifiable breach to the ICO within 72 hours of becoming aware of it. Failure to report can result in regulatory action on top of the breach itself. Your website is not just a marketing tool — it is a data-handling system, and the law treats it as one.

Group discussing website security risks at café

A professionally built, trust-signalling website that runs over HTTPS is also a visible trust signal to customers. Browsers now flag any site without a valid TLS certificate as “Not secure,” and that warning alone can drive visitors away before they read a single word.

Infographic showing 2026 website security action steps

Website security checklist: the high-impact controls every small business needs

These six controls address the most common causes of compromise. Work through them in order — each one builds on the last.

  1. SSL/TLS certificate (HTTPS)
    What to do: Confirm your site loads over HTTPS. If it does not, install a certificate. Most managed hosting providers include one automatically; if yours does not, Let’s Encrypt provides free, automated TLS certificates with auto-renewal.
    Time: 5–30 minutes.
    Cost: Free (Let’s Encrypt) to ~£60/year for extended validation certificates.

    Pro Tip: Enable automatic TLS renewal in your hosting control panel. A lapsed certificate shows the same “Not secure” warning as having no certificate at all, and it can happen overnight.

  2. Strong passwords and a password manager
    What to do: Replace all admin passwords with unique, complex ones. Use a password manager (Bitwarden, 1Password, or Dashlane all work well) so you never reuse credentials. Change any default passwords on your CMS, hosting panel, or database immediately.
    Time: 30 minutes.
    Cost: Free (Bitwarden has a solid free tier).

  3. Multi-factor authentication (MFA)
    What to do: Enable MFA on your website admin panel, hosting account, domain registrar, and email. App-based MFA (Google Authenticator, Aegis, or Authy) is more secure than SMS codes.
    Time: 10–20 minutes per account.
    Cost: Free.

  4. Platform, plugin, and theme updates
    What to do: Update your CMS (WordPress, for example), all plugins, and all themes to their latest versions. Outdated plugins and weak passwords are the leading causes of SME website compromise. On WordPress, enable automatic background updates for minor releases.
    Time: 30 minutes initially; 15 minutes weekly thereafter.
    Cost: Free.

    Pro Tip: Test major plugin updates on a staging copy of your site before applying them to the live version. A plugin conflict can take your site offline just as effectively as an attack.

  5. Automated off-site backups
    What to do: Schedule daily backups that are stored separately from your hosting server. Verify the backup actually restores — a backup you have never tested is not a backup you can rely on.
    Time: 30 minutes to set up.
    Cost: £0–£5/month depending on your host.

  6. User access control (least privilege)
    What to do: Give each team member only the access level they need. No one should browse the web or check email from an Administrator account. Remove access for former employees immediately.
    Time: 15–30 minutes.
    Cost: Free.

The NCSC small organisations guide confirms that distributing these tasks across your team and completing them in short sessions dramatically reduces your risk profile. You do not need a dedicated IT department to get this right.

Hands setting up automated backups at desk

How to do the highest-impact tasks: step-by-step

The four tasks below deliver the biggest risk reduction per hour of effort. Each one is something you can do yourself or brief a web support provider to handle.

Installing or verifying SSL/TLS

  1. Type your domain into a browser and check for the padlock icon and “https://” in the address bar.
  2. If it shows “Not secure,” log in to your hosting control panel and look for an SSL or Let’s Encrypt section.
  3. Click “Install” or “Enable.” Most modern hosts (including cPanel and Plesk setups) do this in one click.
  4. Force HTTPS by adding a redirect rule in your .htaccess file or via your CMS settings.
  5. Test the result at SSL Labs — aim for a grade of A or above.

Safety note: Always take a full backup before editing .htaccess or server configuration files.

Enabling MFA on WordPress

  1. Install an MFA plugin (WP 2FA or Two Factor are both well-regarded).
  2. Activate it and follow the setup wizard to link your authenticator app.
  3. Enforce MFA for all Administrator and Editor roles in the plugin settings.
  4. Test the login flow on a second device before logging out.

Pro Tip: Prefer an app-based authenticator over SMS wherever the option exists. SIM-swap attacks can intercept SMS codes; an app-based code lives only on your device.

Running updates safely

  1. Back up the site first. Always.
  2. Update the CMS core first, then themes, then plugins — in that order.
  3. Check the site visually after each update batch. If something breaks, restore the backup and investigate.
  4. On Shopify or Wix, platform updates are handled automatically, but third-party apps still need review. Check your app list quarterly and remove anything you no longer use.

Setting up automated backups

  1. In your hosting panel, find the backup or snapshot tool.
  2. Set the schedule to daily and the retention period to at least 14 days.
  3. Configure the backup destination to an off-site location (a separate cloud storage account, not just a folder on the same server).
  4. Once set up, run a manual restore test to a staging environment to confirm the backup file is valid.

Backups and incident recovery: how to prepare and test restores

Testable, off-site backups are the single most important recovery tool you have. Without them, a ransomware attack or accidental deletion can mean starting your website from scratch.

Business criticality Backup frequency Minimum retention Suggested method
Low (brochure site, rarely updated) Weekly 30 days Hosting panel snapshot
Medium (blog, booking forms, contact data) Daily 14 days Hosting panel + off-site cloud copy
High (e-commerce, live bookings, customer accounts) Hourly or continuous 30 days Dedicated backup service + off-site

Restore test checklist

Run this test at least once a quarter:

  • Select a backup from at least 7 days ago (not just the most recent one).
  • Restore it to a staging or test environment, not the live site.
  • Confirm all pages load correctly and all forms submit without errors.
  • Check that the database is intact (log in, view recent orders or posts).
  • Document the time taken from start to finish — this is your real Recovery Time Objective (RTO).

Knowing your RTO before an incident means you can set realistic expectations with customers and staff if something goes wrong.

Incident recovery sequence

If your site is compromised, work through these steps in order:

  • Contain: Take the site offline or put it in maintenance mode immediately to prevent further damage or data exposure.
  • Preserve evidence: Screenshot error messages, note timestamps, and do not delete any files before a security scan.
  • Change credentials: Reset all passwords for the CMS, hosting, FTP, and database from a clean, unaffected device.
  • Notify your host: They may have server-level logs or can isolate your account.
  • Restore from a clean backup: Use the most recent backup that predates the compromise, not the most recent backup (which may already be infected).
  • Notify the ICO if needed: If personal data was exposed, you have 72 hours from becoming aware of the breach to report it.

How do you detect a breach and what should you do immediately?

Speed matters. The longer a compromised site stays live, the more customer data is at risk and the harder recovery becomes.

Immediate actions on detecting a breach:

  • Take the site offline or enable maintenance mode straight away.
  • Do not delete files or logs — preserve everything for investigation and any potential ICO report.
  • Change all admin passwords and revoke active sessions from a clean device.
  • Contact your hosting provider; request server access logs and ask them to check for malicious files.
  • Restore from a clean, pre-compromise backup once you have scanned and confirmed it is uninfected.
  • Notify affected customers if their personal data was accessed or exfiltrated.

For the ICO report, you will need: a description of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken to address it. The ICO’s practical guidance for small organisations walks through this clearly.

The NCSC’s Response and Recovery guide is the best free resource for UK small businesses at this stage. It covers evidence preservation, communication, and how to rebuild securely.

If the breach involves ransomware, significant data loss, or a sophisticated intrusion you cannot explain, bring in a professional incident response firm. Trying to clean a deeply compromised server without specialist help often makes things worse and can destroy evidence needed for an insurance claim or regulatory report.

How much does website security cost for UK small businesses?

Basic protection is genuinely low cost. The average SME breach, at £6,400, costs far more than a year of preventive measures.

Security measure Typical UK cost Time to implement
SSL/TLS certificate (Let’s Encrypt) Free 5–30 minutes
SSL/TLS certificate (paid, extended validation) £30–£60/year 1–2 hours
Daily automated backups £0–£60/year 30 minutes
Web application firewall (WAF) £10–£30/month 1–2 hours
Uptime and malware monitoring £5–£20/month 30 minutes
Password manager (team plan) £3–£5/user/month 30 minutes
Cyber Essentials certification £300–£500 (self-assessed) 1–3 days
Professional penetration test £500–£2,000+ 1–5 days (external)
Pay-monthly managed hosting with security included £20–£60/month Immediate

The reality check: a pay-monthly managed hosting plan that bundles SSL, daily backups, updates, and monitoring often costs less annually than assembling those services separately and spending the time to manage them. Ongoing personalised support removes the maintenance overhead entirely, which for a small business owner is often the bigger saving.

For most small businesses, the highest-value path is: free controls first (SSL, MFA, updates, passwords), then a modest monthly plan for backups and monitoring, then Cyber Essentials if you work with public sector clients or want the certification as a trust signal.

Which tools and services should you consider for your website’s security?

Five categories cover the core needs for most small businesses. You do not need all of them on day one — prioritise in the order listed.

  • SSL/TLS via Let’s Encrypt: Free, automated, and supported by virtually every modern hosting provider. If your host does not include it, that is a red flag about the host, not a reason to pay for a certificate elsewhere.
  • Web application firewall (WAF): Sits in front of your site and blocks common attacks (SQL injection, cross-site scripting, brute-force login attempts) before they reach your server. Cloud-based WAF services are available at modest monthly costs and require no server access to configure.
  • Automated backup service: Your hosting panel’s built-in backup tool is a good start, but a dedicated service that stores copies off-site and sends you a daily confirmation gives you an extra layer of assurance.
  • Uptime and malware monitoring: A monitoring service checks your site every few minutes and alerts you by email or SMS if it goes down or if a known malicious file signature is detected. Many small businesses discover breaches this way before customers do.
  • Password manager: Bitwarden (free for individuals, affordable for teams), 1Password, and Dashlane all support shared vaults, making it practical for a small team to use strong, unique credentials without the chaos of spreadsheets.
  • App-based 2FA: Google Authenticator, Aegis (Android), or Authy. All free. Pair with your password manager for a complete credential security setup.

Cyber Essentials certification is worth considering if you tender for government contracts or work with larger clients who ask for evidence of your security posture. The self-assessed route costs £300–£500 and covers the five controls that stop the most common attacks. The NCSC backs the scheme and lists it as the recommended next step beyond the basic guide.

When choosing a managed hosting provider, look for: TLS included by default, daily backups with off-site storage, automatic CMS and server-level security updates, and a clear policy on what happens if your site is compromised. Red flags include no mention of backups in the plan, shared IP addresses with no isolation, and support that is only available by ticket with multi-day response times.

What does UK data actually tell us about small business cyber risk?

UK evidence is clear: small firms are frequently targeted, and the financial impact is growing.

“The Cyber Security Breaches Survey is the UK government’s primary measure of cyber resilience across businesses of all sizes. Its findings consistently show that small and micro-businesses face the same threat landscape as larger organisations, but with far fewer resources to respond.” — Cyber Security Breaches Survey 2025/2026, GOV.UK

Three sources underpin the recommendations in this guide:

  • Cyber Security Breaches Survey 2025/2026 (GOV.UK): The definitive annual measure of UK cyber resilience. The 43% overall business breach rate, 46% for small businesses, and 42% for micro-businesses are the most cited figures in UK cybersecurity policy and justifies treating prevention as a business priority, not an IT afterthought.
  • AMVIA UK SME Cybersecurity Research 2026: Puts the average breach cost at £6,400, up 52% from 2024. The rising trend matters as much as the absolute figure — waiting another year to act means the potential cost of inaction is higher.
  • NCSC Cyber Action Toolkit: The practical starting point the NCSC recommends for sole traders and small businesses. It generates a personalised action plan in under 15 minutes and is entirely free.

The ICO’s guidance for small organisations covers the data-handling side: backups, strong passwords, 2FA, and secure disposal of IT equipment. These are not optional best practices — they are the baseline the ICO expects when it investigates a breach.

How do website firewalls and advanced threat protection actually work?

A web application firewall (WAF) is the most practical advanced protection tool for a small business website. It sits between your visitors and your server, inspecting incoming traffic and blocking requests that match known attack patterns.

Common attacks a WAF stops include SQL injection (where an attacker tries to manipulate your database through a form field), cross-site scripting (injecting malicious code into your pages), and brute-force login attempts (automated tools trying thousands of password combinations). Without a WAF, these attacks reach your server directly.

Cloud-based WAF services work without any server access — you point your domain’s DNS records at the WAF provider, and it proxies all traffic through its filters. This makes them practical for small businesses that do not have a server administrator. Many managed hosting plans include a basic WAF at the server level.

Beyond a WAF, consider these threat protection layers:

  • Malware scanning: Scheduled scans of your website files against known malware signatures. Many hosting providers include this; standalone tools are also available.
  • Login attempt limiting: Restrict the number of failed login attempts before an IP address is temporarily blocked. On WordPress, plugins handle this in minutes.
  • File integrity monitoring: Alerts you when core CMS files are modified unexpectedly, which is often the first sign of a compromise.
  • Content Security Policy (CSP) headers: HTTP headers that tell browsers which scripts and resources are allowed to load on your pages, reducing the risk of cross-site scripting attacks.

None of these require specialist knowledge to set up on a managed platform. The key is layering them — no single tool catches everything, but together they raise the cost of attacking your site high enough that most automated attacks move on.

Should you get a website security audit or penetration test?

A security audit reviews your site’s configuration, software versions, access controls, and known vulnerabilities. A penetration test goes further: a qualified tester actively attempts to exploit weaknesses, the way a real attacker would.

For most small businesses, a structured self-audit using the NCSC checklist and a free tool like the NCSC’s Check Your Cyber Security tool is the right starting point. It costs nothing and surfaces the most common gaps in under an hour.

A professional penetration test makes sense when:

  • You handle significant volumes of customer payment or personal data.
  • You are applying for Cyber Essentials Plus certification (which requires an external vulnerability assessment).
  • A client or insurer requires evidence of a formal test.
  • You have made significant changes to your site’s architecture or added new integrations.

Penetration tests for small business websites typically cost £500–£2,000 depending on scope. Always use a tester who holds a recognised qualification (CHECK, CREST, or Cyber Scheme are the main UK standards). Ask for a written report with a prioritised remediation list, not just a pass/fail result.

Run a self-audit at least annually and after any significant site change. A penetration test every 12–24 months is reasonable for businesses in the medium-to-high criticality bracket.

UK GDPR is the most widely known obligation, but it is not the only one. Here is a clear picture of what applies to small businesses.

UK GDPR and the Data Protection Act 2018: If a breach is likely to result in a risk to individuals’ rights and freedoms (for example, exposure of names, email addresses, payment details, or health information), you must notify the ICO within 72 hours. If the risk is high, you must also notify the affected individuals directly. Keep a record of all breaches, even those you decide do not require ICO notification.

Network and Information Systems (NIS) Regulations: These apply to operators of essential services and relevant digital service providers (including certain online marketplaces and search engines). Most small businesses fall outside scope, but if you operate in a sector covered by NIS (energy, transport, health, digital infrastructure), check your obligations with a legal adviser.

Computer Misuse Act 1990: Relevant if you are the victim of an attack — it criminalises unauthorised access to computer systems. Report attacks to Action Fraud (0300 123 2040) as well as the ICO where data is involved.

Payment Card Industry Data Security Standard (PCI DSS): If your website processes card payments directly (not via a hosted payment page from a provider like Stripe or PayPal), PCI DSS compliance is a contractual obligation with your payment processor. A breach involving card data triggers additional notification requirements to your processor and potentially to card schemes.

Cyber insurance: Not a legal obligation, but worth noting. Many UK insurers now require evidence of basic controls (MFA, backups, patching) before issuing a policy. A breach without insurance and without those controls in place can leave you personally liable for recovery costs.

This article is general information, not legal advice. Confirm your specific obligations with the ICO or a qualified legal professional for your situation.

How do you train your staff on website security best practices?

Human error causes more breaches than technical failures. Training your team is one of the highest-return investments you can make.

The NCSC offers a free, self-paced training module called Top Tips for Staff that covers phishing, passwords, and safe online behaviour. It takes under 30 minutes and requires no technical knowledge. For a small team, running this together in a single session is more effective than sending a link and hoping people click it.

Practical steps for building a security-aware team:

  • Hold a short monthly check-in (10–15 minutes) to share any new phishing examples or security news relevant to your sector.
  • Create a simple, written policy covering: how to report a suspected phishing email, who to contact if a device is lost or stolen, and what to do if a login credential is compromised.
  • Run a simulated phishing test once or twice a year. Free tools exist for this, and the results are usually more persuasive than any training slide.
  • Make it easy to report concerns without blame. Staff who fear being criticised for clicking a suspicious link will not report it — and that silence is far more dangerous than the click itself.

Phishing is the most common initial attack vector for small businesses. Train your team to check sender addresses carefully, hover over links before clicking, and treat any unexpected request for login credentials or payment as suspicious until verified by phone. The NCSC’s guidance on spotting and reporting phishing scams is a practical reference to share with your team.

Key takeaways

Strong website security for small businesses comes down to six controls, applied consistently: SSL/TLS, MFA, regular updates, tested backups, strong passwords, and access control.

Point Details
Six controls stop most attacks SSL/TLS, MFA, updates, backups, strong passwords, and access control address the leading causes of SME compromise.
Breach cost vs. prevention cost The average UK SME breach costs £6,400; basic preventive measures cost a fraction of that annually.
72-hour ICO reporting window Any breach likely to risk individuals’ rights must be reported to the ICO within 72 hours of discovery.
Test your backups A backup you have never restored is untested; run a quarterly restore test and record your actual recovery time.
No Worry Websites & Ai Automations Pay-monthly plans include SSL, daily backups, and ongoing support, covering the core controls without DIY overhead.

Your 7-day and 90-day plan:

0–7 days (urgent):

  • Verify HTTPS is active and TLS auto-renewal is on. Success metric: browser shows padlock on all pages.
  • Enable MFA on all admin accounts. Success metric: login requires app-based code.
  • Run all CMS, plugin, and theme updates. Success metric: no outstanding updates in dashboard.
  • Confirm daily backups are running and stored off-site. Success metric: backup log shows successful run.

7–30 days (important):

  • Audit user access and remove any accounts that are no longer needed.
  • Install or configure a WAF and login-attempt limiter.
  • Complete the NCSC Cyber Action Toolkit and work through its personalised recommendations.
  • Brief your team on phishing recognition and run the NCSC staff training module.

30–90 days (worth doing):

  • Run a self-audit using the NCSC Check Your Cyber Security tool.
  • Consider Cyber Essentials certification if you work with public sector clients.
  • Review your cyber insurance position.
  • Schedule a quarterly backup restore test and put it in the diary now.

The reality of website security for small businesses

There is a persistent myth that small businesses are too small to be worth attacking. The data says otherwise. Automated attack tools do not discriminate by company size — they scan the entire internet continuously, looking for unpatched software, weak passwords, and misconfigured servers. A WordPress site running a plugin from 2021 is just as visible to a scanning bot as a corporate server farm.

What I find most telling about the NCSC’s approach is that it does not ask small businesses to become security experts. It asks them to do six things consistently. The Cyber Action Toolkit exists precisely because the NCSC knows that most small business owners will not read a 40-page technical guide. The toolkit takes 15 minutes and produces a list you can act on the same day.

The gap I see most often is not between businesses that know about security and those that do not. It is between businesses that have set things up once and never revisited them, and those that treat security as an ongoing process. A plugin updated in January is not necessarily safe in September. A password that was strong two years ago may have appeared in a data breach since then. The controls are simple; the discipline of maintaining them is where most small businesses fall short.

Managed hosting with security built in is not a luxury for small businesses. For many, it is the most practical way to keep those controls active without dedicating hours each month to maintenance. The cost of a monthly support plan is a rounding error compared to £6,400 and the reputational damage of a public breach.

How No Worry Websites & Ai Automations takes the security burden off your plate

Getting a secure website built and kept secure is one of the most practical things you can do for your business — and it does not have to mean managing it yourself.

No Worry Websites & Ai Automations

No Worry Websites & Ai Automations builds pay-monthly bespoke websites that include SSL certificates, daily backups, and ongoing support as standard. There is no upfront cost, no annual renewal admin, and no chasing a developer every time a plugin needs updating. Every site comes with a free domain, green hosting, and a named point of contact who handles changes and security maintenance for you. For a small business owner whose time is better spent on customers than on server logs, that is the practical alternative to the DIY checklist.

If you are ready to get a secure, professionally built website without the ongoing overhead, see what is included in our bespoke packages or get in touch to book a no-pressure call and find out what the right setup looks like for your business.

Authoritative sources and further reading

These are the official, practical sources to check next — all UK-focused and free to access.

  • NCSC Small Organisations Guide to Cyber Security: The NCSC’s primary practical guide for businesses with up to 250 employees. Covers backups, passwords, updates, phishing, and device security in plain language.
  • NCSC Cyber Action Toolkit: Generates a personalised action plan for sole traders and small businesses in under 15 minutes. Free, no registration required.
  • Cyber Security Breaches Survey 2025/2026 (GOV.UK): The annual official statistic on UK cyber resilience. The primary source for breach frequency and impact data across businesses of all sizes.
  • ICO Practical Guidance for Small Organisations: Covers data security obligations, backups, passwords, 2FA, and what to do when something goes wrong. Essential reading for understanding your legal baseline.
  • NCSC Small Business Guide: Response and Recovery: Step-by-step guidance for responding to and recovering from a cyber incident. Use this before an incident happens, not after.

Article generated by BabyLoveGrowth

Share this article
Mark Jones, owner of No Worry Websites
Written by Mark Jones

Owner of No Worry Websites. Mark has run small businesses for nearly 20 years and now builds and looks after websites for small businesses across Northamptonshire and the UK.

More about Mark
Keep reading

More articles you might like

Ready to stop worrying about your website?

Book a free, no obligation 15 minute call and we will talk you through the best option for your business.

Book a 15 minute call
01933 812152
Scroll to Top