2026-10-16 · By Chris Kirby

Is my website secure? 6 simple checks for UK small businesses

"Is my website secure?" is one of those questions most small business owners ask once, usually after a scary news story, and then quietly park. The site works, customers can find you, and whoever built it probably sorted the security side. Probably.

The trouble is that "probably" is doing a lot of work. The UK government's Cyber Security Breaches Survey 2025 found that 43% of UK businesses reported a cyber breach or attack in the previous 12 months, and phishing was by far the most common kind. The National Cyber Security Centre's small organisations guide is blunt about it too: if you think your business is too small to be a target, think again.

The good news is that you don't need to be technical to get a decent answer. Here are six checks anyone can understand.

1. Does your site show the padlock?

Visit your website and look at the address bar. You should see a padlock (or a "tune" icon in newer browsers) and the address should start with https://. That means visitors' connection to your site is encrypted, so things like contact form details can't easily be read in transit.

Try typing your address with http:// at the start too. A well-set-up site will jump straight to the secure https:// version. If it doesn't, or you see a "Not secure" warning, that's worth fixing quickly. Browsers flag it, and customers notice.

2. Is the security certificate about to expire?

The padlock depends on a security certificate, and every certificate has an end date. Many are renewed automatically, but automatic renewal fails more often than you'd think: a card expires, a hosting account changes, a setting gets lost in a migration. When a certificate lapses, visitors get a full-page warning and most of them leave.

You can click the padlock to see the expiry date. Better still, have something watch it for you so you hear about a problem before your customers do.

3. Is the software up to date?

If your site runs on WordPress, Wix, Squarespace or similar, ask whoever looks after it one simple question: "Are the site, its theme and its plugins kept up to date?" Out-of-date plugins are one of the most common ways small business websites get broken into. The government survey found only around a third of businesses have a policy to apply security updates within 14 days, so if you're unsure, you're not alone, but it's worth asking.

4. Who can log in, and how?

Think about everyone who has a login to your website's admin area, your hosting account and your domain registrar. Old web designers, a former employee, a freelancer from three years ago? Remove anyone who no longer needs access.

Then turn on two-step verification (sometimes called 2FA or MFA) wherever it's offered. It means a stolen password isn't enough on its own. The NCSC recommends it as one of the most effective things a small organisation can do, and it usually takes about five minutes.

5. Could someone send emails pretending to be you?

This one surprises people. Your website address is also your email domain, and unless it has the right settings, scammers can send emails that look like they come from you@yourbusiness.co.uk. Customers and suppliers have no easy way to tell the difference.

The settings that stop this are called SPF, DKIM and DMARC. You don't need to know how they work, just whether they're in place. If you've ever seen a "DMARC check failed" message, or you've never heard of any of them, it's worth checking your domain.

6. What can the outside world see?

Attackers don't start by guessing. They start by looking at what's publicly visible: which services your server offers to the internet, which software versions it advertises, and which basic security settings are missing. That outside view is exactly what an automated attack sees, so it's the view you want to check too.

How to test it in a couple of minutes

You could work through all of that by hand, or you can let a tool do the legwork. Our free check at tidycyber.co.uk looks at your website and domain from the outside, the same way an attacker would, and gives you a plain-English result. It covers your padlock and certificate, your email spoofing protection (SPF and DMARC), and other common gaps. You don't need to install anything or give anyone access to your systems.

If you want more detail, the £29 External Vulnerability Assessment report goes deeper and explains what to fix and in what order, written so you can hand it straight to your web person. Once you have a report, Monitoring at £12 a month keeps an eye on things like certificate expiry and email settings and sends a quiet weekly alert only when something new goes wrong, and Monitor+ at £39 a month covers up to five domains with daily alerts.

The short version

A secure website isn't about being an expert. It's about a handful of basics: the padlock works, the certificate won't quietly expire, the software is updated, logins are tidy and protected, and your domain can't easily be used to impersonate you. Most of these take minutes to sort once you know they need attention.

So, is your website secure? You don't have to guess. Run the free check on tidycyber.co.uk and find out in a couple of minutes.