Website Security for Conveyancing Solicitors in the UK

Why Conveyancing Firms Are High-Value Targets

Conveyancing sits at the intersection of large financial transfers and personal data. A single transaction involves a buyer's full identity, financial position, mortgage details, and property ownership records. The completion of that transaction triggers a transfer of funds — often six or seven figures — via client accounts.

This combination makes conveyancing firms one of the most targeted sectors in UK cybercrime. The Solicitors Regulation Authority has published repeated warnings about cyber fraud affecting property transactions. Conveyancing solicitors have been defrauded by attackers who intercepted email communications, substituted bank details, and caused completion funds to be sent to fraudsters rather than the correct recipients.

The website is not always the direct attack vector, but it is part of the attack surface — and weaknesses in the web presence can be exploited to gain a foothold in the firm's broader systems.

The SRA's Expectations on Cyber Security

The Solicitors Regulation Authority's Standards and Regulations require solicitors to maintain effective systems and controls to protect client money and assets. Cyber security is explicitly within scope. The SRA has taken regulatory action against firms that suffered cyber-enabled client account fraud where appropriate controls were not in place.

The SRA Accounts Rules require firms to maintain client money safely. If a breach of the firm's systems contributes to the loss of client funds, the firm faces both regulatory scrutiny and potential civil liability.

The SRA has published a cyber security toolkit for law firms specifically addressing phishing, ransomware, and business email compromise — the three primary vectors used against conveyancing practices.

UK GDPR adds further obligations. Property transaction data includes information about financial circumstances, identity documents, and home addresses — personal data requiring appropriate technical and organisational security measures.

Common Attack Vectors Against Conveyancing Websites

Business email compromise via domain spoofing

Attackers register domains that closely resemble a conveyancing firm's domain — substituting letters, adding hyphens, or using alternative TLDs. They then send emails to clients appearing to come from the firm, providing fraudulent bank details for completion funds.

Properly configured email authentication records (SPF, DKIM, DMARC) help prevent attackers from sending emails that appear to originate from the firm's own domain. Missing or misconfigured records leave this attack avenue open.

Client portal compromise

Many conveyancing firms now use online client portals for document exchange, e-signature, and progress updates. If these portals have weak authentication, inadequate session management, or IDOR vulnerabilities, an attacker can access another client's transaction documents without authorisation.

Contact form and enquiry injection

Quote request forms and initial enquiry flows that lack proper input validation can be exploited via cross-site scripting or SQL injection. More practically, they represent a social engineering vector — responses to enquiry forms are automatically trusted by recipients in a way that cold emails are not.

Outdated website platforms

Conveyancing firms often use websites built by local agencies on WordPress or similar platforms, then left largely unmaintained. Outdated plugins, abandoned themes with known vulnerabilities, and default administrator credentials are common findings.

Information disclosure

Websites that expose directory listings, configuration files, or document URLs under predictable paths can inadvertently give attackers access to transaction-related documents or system configuration information.

What a Security Assessment Covers

A web security assessment for a conveyancing firm examines the internet-facing systems — the firm's website and any web-accessible client portal. It does not access internal network systems or the practice management software, which requires a different type of assessment.

The assessment covers injection vulnerabilities in any forms or search functionality, authentication security on any login portals, HTTP security headers that protect visitors from client-side attacks, email authentication configuration, TLS certificate and configuration quality, exposed sensitive paths and files, subdomain enumeration and takeover risk, and information disclosure via HTTP response headers or page source.

For firms with client portals, an authenticated assessment — where the tester is given a test account — can additionally review access controls between clients and the authorisation logic protecting transaction documents.

Specific Recommendations for Conveyancing Practices

**Implement DMARC at enforcement policy** — A DMARC record set to p=reject tells receiving mail servers to reject emails that claim to come from your domain but fail authentication checks. This is the single most impactful technical control against domain spoofing. Many conveyancing firms have SPF records but no DMARC, leaving the spoofing vector open.

**Restrict or require authentication for any online documents** — If your website or portal makes any transaction documents accessible via URL, ensure those URLs are not predictable and require authentication. An authenticated session that expires after inactivity is the minimum standard.

**Segregate your website from your email and practice management system** — Your public website and your internal systems should share as little infrastructure as possible. A compromise of the website hosting environment should not give an attacker access to client data or email.

**Train staff on payment detail changes** — The most effective property fraud does not always exploit a technical vulnerability. Attackers who have compromised email accounts or who have registered lookalike domains intercept legitimate email threads and substitute bank details. Staff need to verify payment detail changes by phone using independently sourced numbers.

**Run a web security assessment annually** — Your website changes over time as plugins are updated, new features are added, and third-party integrations are introduced. An annual assessment provides a baseline you can act on and demonstrates to regulators and PI insurers that you take security seriously.

Professional Indemnity Insurance and Security Posture

Professional indemnity insurers are increasingly asking conveyancing firms about their cyber security controls at renewal. Firms that can demonstrate regular security assessments, DMARC enforcement, MFA on email, and staff training on cyber fraud are better positioned during underwriting and in the event of a claim.

A documented history of security assessments, together with evidence of remediation, is the kind of record that demonstrates a firm operated to a reasonable standard of care — relevant both to regulatory investigations and civil proceedings.

Yrzo AI runs 44 automated security checks against your website and delivers a prioritised report in under 20 minutes. Starting from £399 at yrzoai.dev.