Website Security for Small Businesses UK: A Plain-English Guide

Website security for small businesses in the UK: a plain-English guide

Most website security advice is written for people who already understand it. This guide is not. It is written for business owners who know they should probably be doing something about their website security but are not sure what, why, or how much it should cost.

Why small businesses are targeted more than they realise

There is a widespread assumption that hackers go after big companies. This is wrong. Large companies have dedicated security teams, intrusion detection systems, and incident response plans. Small businesses usually have none of these things.

Automated attack tools do not discriminate by company size. They scan the internet continuously, looking for known vulnerabilities in websites. When they find one, they exploit it — whether the site belongs to a multinational or a sole trader in Manchester.

According to the UK government's 2024 Cyber Security Breaches Survey, 50% of UK businesses experienced a cyber attack or breach in the previous 12 months.

The most common ways small business websites get compromised

Weak or reused passwords on the admin panel. Attackers run automated tools that try thousands of common passwords against login forms. If your website admin uses a weak password — or the same password as another account that has been leaked — it is only a matter of time.

Outdated software. WordPress powers around 40% of all websites. New vulnerabilities are found in WordPress core and its plugins regularly. Attackers actively scan for sites running outdated versions and exploit them automatically.

No HTTPS or expired SSL certificate. Any site that is not served over HTTPS is transmitting data between your visitors and your server in plain text.

Contact forms that accept malicious input. If your forms do not validate and sanitise what users submit, they can be used to inject malicious code into your database.

No email authentication. Without SPF, DKIM, and DMARC records on your domain, anyone can send emails that appear to come from your business.

What you actually need to do

Keep everything updated. WordPress core, themes, plugins, PHP version, server software. Set automatic updates wherever possible.

Use strong, unique passwords. Every admin account, every service, every API key. Use a password manager. Enable two-factor authentication on your admin panel.

Make sure HTTPS works correctly. Not just that you have a certificate, but that all traffic redirects to HTTPS and your certificate is current.

Set up email authentication. Ask your developer or hosting provider to add SPF, DKIM, and DMARC records to your domain's DNS settings.

Back up regularly. Daily automated backups stored separately from your live server. Test the restore process.

Test your security. The steps above reduce your exposure. Testing tells you whether you have a vulnerability despite following best practices.

How much does it cost to do this properly

Most of the above is free or already included in your hosting. The one item with a cost is security testing. A traditional penetration test from a UK security firm costs £5,000 to £15,000 for a web application engagement.

Yrzo AI offers automated penetration testing at £399 per scan. It runs 44 security checks against your live website and delivers a plain-English report with specific fixes. For most small businesses, this is the right level of testing.

What happens if you do not do it

The most common outcome is a quiet breach that goes undetected for months. Customer data is extracted and sold or used for fraud. At some point you find out — through a customer complaint, a breach notification, or an ICO investigation. At that point you are dealing with legal obligations, potential fines, customer notifications, and reputational damage.

The cost of not taking security seriously is not zero. It is deferred, and when it arrives, it is much larger than the cost of prevention.