Website Security for Architects in the UK

What Architecture Practices Hold

An architectural practice accumulates a specific and underappreciated category of sensitive data. Client project files contain the address and layout of the client's home or business premises — sometimes accompanied by security information (location of safes, camera coverage, alarm system placement in building specifications). Fee proposals and appointment letters record the client's contact details and a financial relationship. Planning applications submitted through the council portal contain the client's address as the applicant, sometimes alongside personal statements of circumstances supporting the application.

For residential projects — extensions, new builds, conversions — the combination of a client's address, their absence schedule (if discussed for access during works), and knowledge of the layout of their property is a meaningful physical security risk if that data is compromised or accessed by a bad actor. This is not a theoretical concern; it is the reason that property-related businesses are disproportionately targeted by social engineering and business email compromise.

UK architects registered with the ARB are subject to UK GDPR as data controllers for client and project information. The ICO's guidance covers technical and organisational measures for all personal data processed, including project correspondence, client contact details, and any documents held on behalf of clients.

The Website Attack Surface for Architecture Practices

**Project enquiry and brief submission forms** — Initial contact forms on architecture practice websites often collect the project address, type of works, budget range, and contact details. This data is sensitive from submission — it links a person's identity to their home address and financial capacity for building work.

**Portfolio pages with project photographs** — Project portfolios sometimes include images that inadvertently reveal security-relevant details about completed residential properties (layout, entry points, valuables visible in professional photography). While this is a content decision rather than a technical vulnerability, it is worth considering what is published.

**Client login areas and document portals** — Where the practice offers a client portal for sharing drawings and documentation, the authentication security of that portal protects the full contents of the project file.

**Third-party document sharing** — Many architects use third-party platforms (WeTransfer, Dropbox, Google Drive) to share large drawing sets. The security of those links — whether they expire, whether they require authentication, whether they are enumerable — determines how well the content is protected.

**Planning portal integration** — Some practice websites include direct links to planning applications, which are public documents. This is not a vulnerability, but practices should be aware that published planning documents contain client addresses and are permanently publicly accessible.

Business Email Compromise Risk

Architecture practices are squarely in the target profile for business email compromise (BEC) attacks. Projects involve large contractor payments, specialist subcontractor fees, and sometimes client fund management for project-specific accounts. An attacker who gains access to a practice's email — or who spoofs the practice's domain effectively — can intercept payment correspondence and divert funds.

The trigger is usually a request to update bank details mid-project, framed as coming from the architect, a contractor, or the client. Without DMARC at enforcement on the practice's domain, the practice's email address can be spoofed in emails to their clients and contractors.

Check DMARC configuration at mxtoolbox.com. If the record is missing or at `p=none`, this is a priority fix before anything else on the security list.

Practical Controls

Enable MFA on email, practice management software, and any document portal. Review what enquiry forms collect and where those submissions are stored — WordPress database tables accessible through an admin panel are a common insecure collection point for enquiry data.

For project files shared with clients and contractors, use sharing links that require authentication or that expire after a set period, rather than permanent public links. Maintain a record of what has been shared with whom, so access can be revoked when a project closes.

Review your portfolio content for residential projects — consider whether images reveal security-relevant information about occupied properties, and whether the project address is published alongside photographs.

The [GDPR website security requirements](/blog/gdpr-website-security-requirements-uk) guide covers the technical obligations that apply to all UK businesses processing personal data. For understanding penetration testing for professional services firms, [penetration testing for architects](/blog/penetration-testing-architects-uk) has context on scope and cost.

Yrzo AI's automated security assessment scans architecture practice websites across 54 checks including form security, email configuration (DMARC/DKIM/SPF), authentication controls, HTTP security headers, and SSL. Plain-language findings in minutes. From yrzoai.dev.