Website security checklist for UK businesses
Most website security guides are either too technical for business owners or too vague to be useful. This checklist tells you exactly what to check, how to check it, and what to do if something is wrong.
SSL and HTTPS
Does your site use HTTPS? The address bar should show a padlock and start with https://
Does HTTP redirect to HTTPS? Type http:// before your domain — you should be automatically redirected.
Is your SSL certificate valid and not expiring soon? Click the padlock and check the expiry date. Renew if expiring within 60 days.
Is HSTS enabled? Check using securityheaders.com.
Security headers
Check your security headers at securityheaders.com. You should see green ratings for Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
Email authentication
Check your SPF record using mxtoolbox.com/spf. Check your DMARC record using mxtoolbox.com/dmarc. A missing SPF or DMARC record means anyone can spoof your domain.
Admin panel and login
Type /admin, /wp-admin, /login after your domain. If a login form appears accessible to anyone, consider restricting access by IP address.
Are you using two-factor authentication on your admin account?
Software and updates
Is your CMS up to date? Are all plugins and themes updated? Remove any you are not actively using.
Backups
Do you have automated daily backups stored separately from your main hosting?
The checks you cannot do yourself
The items above cover surface-level security. They do not tell you whether your contact form can be used to extract your database, whether your login can be bypassed, or whether your site has misconfigurations an attacker could exploit.
Yrzo AI runs 75+ automated security checks against your live website and delivers a plain-English report in under 20 minutes. Starting at £149.
Find out if your website has these vulnerabilities
Yrzo AI runs 44 automated security checks and delivers a full report in under 20 minutes. Starting from £149.
Scan your website →