Website Security for UK Tradesmen and Trade Businesses

Why Tradesmen Are Targeted

The assumption that cybercriminals only target large businesses is one of the most dangerous beliefs a small trade business can hold. In practice, attackers specifically seek out small businesses — tradesmen, sole traders, and small contractors — because they are far less likely to have any security measures in place, they handle customer data that has real value, and compromising their systems is often trivially easy.

A plumber's website that has been running on the same WordPress installation for four years without updates is a realistic target. An electrician whose contact form sends enquiries directly to a Gmail inbox that uses the same password as their supplier portal is a realistic target. A builder whose website is hosted on a shared server alongside dozens of other sites, one of which has an unpatched vulnerability, is a realistic target.

The data at stake is real. Customer enquiries capture names, phone numbers, addresses, and descriptions of the customer's property and when they are likely to be away. Quote requests may include financial information. Invoice emails from trade businesses to customers can be intercepted and modified in payment diversion fraud — one of the most financially damaging attacks hitting UK small businesses.

What Trade Websites Handle

Even a simple trade business website — a few pages describing services, a contact form, and a gallery — handles more sensitive data than most business owners realise.

**Contact and enquiry forms** — Names, email addresses, phone numbers, and property addresses submitted through enquiry forms. If your contact form sends data through an email marketing service or stores it in a database, that data is being processed under UK GDPR. You have legal obligations to protect it.

**Quote request forms** — More detailed property information, scope of work, and sometimes access requirements or security information about the property.

**Invoice and payment correspondence** — If you send invoices by email, those emails are a target for payment diversion fraud. Attackers intercept your invoice email, modify the bank account details, and forward it to the customer. The customer pays the fraudster's account believing they are paying you.

**Customer login areas** — Trade businesses that offer job tracking portals or customer accounts hold a database of customer records that requires protection.

The Most Common Security Issues on Trade Websites

Outdated WordPress or website platform

The majority of trade business websites run on WordPress. WordPress itself is reasonably secure when kept up to date, but the themes and plugins layered on top of it are a consistent source of vulnerabilities. A WooCommerce plugin with an unpatched SQL injection, a booking plugin with an authentication bypass, or a gallery plugin with a file upload vulnerability gives attackers a direct route into the site.

WordPress sites that have not been updated within the last three to six months are running known vulnerabilities. Attackers scan for these automatically and exploit them at scale.

Weak hosting security

Shared hosting — where your website sits on the same server as hundreds of other websites — means that a vulnerability in any one of those sites can be leveraged to access all sites on the server. Reputable hosts isolate accounts from each other, but not all shared hosting providers implement this isolation correctly.

Budget hosting that is several years old and has not been reviewed is a common weak point for trade businesses.

No email authentication

Email authentication — [SPF, DKIM, and DMARC](/blog/http-security-headers-explained-uk) records for your domain — prevents attackers from sending emails that appear to come from your business address. Without these records at enforcement policy, an attacker can send an invoice modification email from an address that looks identical to yours.

DMARC in particular, at `p=reject` policy, is the only technical control that prevents domain spoofing of your email address. Most trade business domains have no DMARC record or have it set to `p=none` — which monitors but does not enforce.

No SSL certificate or expired SSL

All websites should serve over HTTPS. An HTTP contact form sends customer data across the network in plaintext. Google Chrome flags HTTP sites as "Not secure," which harms your conversion rate as well as your customers' data.

SSL certificates expire annually (or more frequently) and must be renewed. An expired certificate generates a browser warning that prevents most visitors from proceeding to your site.

Default admin credentials

WordPress installations that have never had the default `admin` username changed, and use a weak password on the admin account, are vulnerable to brute force attacks. Automated tools scan millions of WordPress sites and attempt common username and password combinations continuously.

Practical Security Steps for Trade Businesses

**Keep your website platform updated** — Enable automatic updates for WordPress core, themes, and plugins where possible. If you manage your website yourself, check for updates at least monthly. If a web developer manages your site, confirm with them that updates are applied regularly.

**Use strong, unique passwords** — Your website admin password, email password, hosting control panel password, and any supplier portal passwords should all be different and strong. A password manager makes this manageable without needing to remember each one.

**Enable two-factor authentication** — Most website admin panels, email providers, and business accounts support [two-factor authentication](/blog/two-factor-authentication-website-security-uk). Enable it everywhere it is offered. It means a stolen password alone is not enough to access your account.

**Set up email authentication** — Ask whoever manages your domain (your web developer, your hosting provider, or your domain registrar) to add SPF, DKIM, and DMARC records. This is a technical change to your DNS settings that protects your business email from being spoofed.

**Back up your website** — A clean, recent backup means that if your website is compromised, it can be restored quickly. Most hosting providers offer automated daily backups. Confirm yours does and verify the backups work.

What Yrzo AI Covers

The [Essential scan (£149)](/checkout/starter) is designed for the type of website most trade businesses operate — a managed or hosted platform, a WordPress site, or a simple brochure site. It covers:

- SSL certificate validity and configuration - Email authentication (SPF, DKIM, DMARC) - Security headers - Common CMS vulnerabilities relevant to WordPress and similar platforms - Exposed admin panels and default login paths - Third-party script risks from embedded tools

The scan produces a PDF report with findings and specific remediation steps — including the exact DNS records to add and the WordPress settings to change. [Start with a free scan](/free) to see your current exposure.

Related reading: [Website Security for Small Businesses UK](/blog/website-security-small-business-uk) · [Two-Factor Authentication for Website Security](/blog/two-factor-authentication-website-security-uk) · [How to Fix Security Headers](/blog/how-to-fix-security-headers-uk)