Website Security for UK Double Glazing and Window Installation Companies

Data Risk in the Double Glazing Sector

Double glazing and window installation companies operate an online quote and lead generation model that collects home addresses, property details, and financial information from prospective customers. The sector has historically been associated with high-pressure sales, and customers are understandably cautious — a website data breach that exposes customer addresses and purchase intent is particularly damaging to trust in this trade.

The data collected through quote forms is also commercially valuable. Lead data for home improvement — address, property type, quote value, and contact details — is worth significant sums on the secondary market. That makes customer databases a target not just for identity fraud but for competitive intelligence theft.

What Double Glazing Websites Collect

**Online quote request forms** — Name, address, contact details, property type, window specification, and estimated number of units. This data profiles the customer's property and their purchase intent.

**Customer accounts and order tracking** — Customers who have placed orders often have accounts showing installation dates, product specifications, and payment schedules. A compromised account exposes financial and property data.

**Payment deposits and finance applications** — Double glazing purchases are often partly or fully financed, with deposits taken online. Card payment data and finance application data (which includes income and employment information) are particularly sensitive.

**Survey booking forms** — Name, address, and preferred appointment time for a home survey. This reveals when the property will be available for access.

Common Vulnerabilities on Double Glazing Websites

**Outdated CMS and lead capture plugins** — Many double glazing websites were built by local web developers and have not been actively maintained. Unpatched WordPress installations and lead generation plugins are a common and exploited vulnerability.

**Lead data stored without access controls** — Quote enquiries are frequently stored in a website database or forwarded to a shared email address. Either storage method is vulnerable to a single compromised login.

**No rate limiting on quote forms** — Without rate limiting, automated tools can submit large numbers of fake enquiries that clog sales pipelines and harvest form response data.

**Missing Content Security Policy** — Without a CSP, third-party scripts (chat widgets, analytics, comparison tools) embedded in the site can be replaced or augmented with scripts that capture what customers submit.

**Finance application data in transit** — If finance application forms route through the company website rather than directly to a lender's secure portal, income and employment data may be inadequately protected in transit.

GDPR Obligations for Window Companies

Customer addresses combined with property details and purchase intent are personal data. You must have a lawful basis for marketing to customers who have submitted enquiries, a data retention policy for quote data that does not convert to orders, and data processing agreements with any third-party CRM or lead management platform you use.

What Yrzo AI Finds on Double Glazing Websites

Common findings when scanning window installation company websites include:

- Quote forms without adequate transport security - WordPress or plugin versions with known CVEs - Lead data stored without encryption in the website database - Admin panels without brute-force protection - Missing security headers - Cookies without Secure or HttpOnly flags

Practical Steps for Window Companies

Use a CRM that is separate from your website and has proper access controls for storing lead data. Ensure any finance application forms redirect to the lender's secure portal rather than routing through your website. Keep your website platform updated. Run a security scan before your next marketing push or peak sales period.

Yrzo AI scans double glazing and home improvement company websites automatically and delivers a plain-English security report with specific remediation steps.