Website Security Checklist for UK Businesses (2026)

Website security checklist for UK businesses

Most website security guides are either too technical for business owners or too vague to be useful. This checklist is different — it tells you exactly what to check, how to check it, and what to do if something is wrong.

Work through each item below. Some you can verify yourself in minutes. Others require a security test to confirm properly.

SSL and HTTPS

✅ Does your site use HTTPS? Type your domain into a browser — the address bar should show a padlock icon and start with https://

✅ Does HTTP redirect to HTTPS? Type http:// before your domain. You should be automatically redirected to the HTTPS version.

✅ Is your SSL certificate valid and not expiring soon? Click the padlock in your browser and check the certificate expiry date. Renew if expiring within 60 days.

✅ Is HSTS enabled? This tells browsers to always use HTTPS. Check using securityheaders.com — enter your domain and look for the Strict-Transport-Security header.

Security headers

✅ Check your security headers at securityheaders.com. You should see green ratings for Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Missing headers are easy fixes your developer can implement in an afternoon.

Email authentication

✅ Check your SPF record using mxtoolbox.com/spf. A missing SPF record means anyone can spoof your domain.

✅ Check your DMARC record using mxtoolbox.com/dmarc. Without DMARC, email spoofing protection is incomplete.

✅ Check your DKIM record — ask your email provider if this is configured.

Admin panel and login

✅ Is your admin panel accessible to anyone? Type /admin, /wp-admin, /login, /administrator after your domain. If a login form appears, consider restricting access by IP address.

✅ Are you using two-factor authentication on your admin account?

✅ When did you last change your admin password? Change it if it has been more than 6 months or if you have shared it with anyone who no longer needs access.

Software and updates

✅ Is your CMS up to date? Log into your admin panel and check for available updates. Apply them immediately.

✅ Are all plugins and themes updated? Check the updates section of your CMS. Remove any plugins or themes you are not actively using.

✅ Do you know what software your site runs on? Use builtwith.com to see what technology your site uses — this also tells you what attackers can see.

Backups

✅ Do you have automated daily backups? Check with your hosting provider or check your backup plugin settings.

✅ Are backups stored separately from your main hosting? A backup stored on the same server as your site is not a real backup — if the server is compromised, so is the backup.

✅ Have you tested restoring from a backup? Many businesses discover their backups do not work when they need them.

Data and privacy

✅ Do you know what personal data your website collects? Name it — contact form submissions, account registrations, purchase records, email addresses.

✅ Is that data stored securely? Ask your developer whether it is encrypted at rest and who has access to the database.

✅ Do you have a privacy policy that accurately describes how you use this data?

The checks you cannot do yourself

The items above cover surface-level security that you can verify without technical knowledge. They do not tell you whether your contact form can be used to extract your database, whether your login page can be bypassed, whether your site has misconfigurations that would allow an attacker to take control.

Those checks require automated security testing tools that probe your site the way an attacker would.

Yrzo AI runs 44 automated security checks — including SQL injection, XSS, IDOR, JWT attacks, SSRF, admin panel exposure, and 38 more — against your live website and delivers a plain-English report in under 20 minutes. Every finding comes with a plain-English explanation and exact steps to fix it.

Starting at £399, it is the most affordable way to get a complete picture of your website security posture rather than just the surface-level checks above.