Is a free SSL certificate good enough?

Yes, for most business websites. Free certificates such as Let's Encrypt provide the same encryption as paid ones. Paid certificates mainly add organisation validation or warranties.

What is DMARC and do I need it?

DMARC is a DNS record that tells email providers how to handle messages that fail SPF and DKIM checks. It helps stop criminals sending email that appears to come from your domain, and major providers increasingly expect it.

Do I need Cyber Essentials?

It's not mandatory for most businesses, but it's required for many UK government contracts and is a good, affordable baseline. It also shows customers you take security seriously.

Cybersecurity4 August 20269 min read

Website and Email Security Checklist for UK Small Businesses

Most attacks on small businesses exploit basics: old software, weak passwords and spoofed email. This checklist covers the essentials.

Illustration of a secure website with padlock and shield icons

On this page

Short answer: most small business websites are compromised through outdated software, weak or reused passwords, or insecure plugins - and most business email fraud relies on spoofed domains. Keep everything updated, turn on multi-factor authentication, take off-site backups, use HTTPS everywhere, and set up SPF, DKIM and DMARC for your email domain.

Why do attackers target small businesses?

Rarely because you are special - usually because automated tools scan the whole internet for known weaknesses. An out-of-date WordPress plugin or a reused admin password is enough. Small businesses are attractive because they often lack the time to patch and monitor.

The UK's National Cyber Security Centre (NCSC) publishes a free Small Business Guide that is well worth reading alongside this checklist.

Website security checklist

1. HTTPS everywhere

Every page should load over HTTPS with a valid SSL/TLS certificate, and HTTP should redirect to HTTPS. Most good hosts provide free certificates that renew automatically. Browsers mark non-HTTPS pages as “Not secure”, which damages trust instantly.

2. Keep software updated

Update your CMS core, themes and plugins promptly - critical security fixes should be applied within days, not months. Remove plugins and themes you no longer use; deactivated code can still be exploited.

3. Use multi-factor authentication (MFA)

Turn on MFA for your website admin, hosting account, domain registrar, email and any cloud services. A stolen password alone is then not enough.

4. Strong, unique passwords

Use a password manager and unique passwords for every account. Never share admin logins - give each person their own account with only the permissions they need.

5. Off-site backups you have tested

Take automatic daily backups stored away from your web server, keep several versions, and test restoring one at least once. A backup you can't restore isn't a backup.

6. Protect your forms

Validate input on the server, use spam protection, and never email sensitive data such as passport numbers or card details through basic contact forms.

7. Security headers and monitoring

A web application firewall, uptime monitoring and security headers (such as HSTS and a content security policy) add layers of protection and tell you quickly when something is wrong.

Business email security checklist

Email is the most common route for fraud - especially invoice scams where criminals impersonate you or your suppliers.

SPF, DKIM and DMARC

These three DNS records prove that email claiming to come from your domain really does:

SPF lists which servers may send email for your domain.
DKIM adds a cryptographic signature to your outgoing email.
DMARC tells receiving servers what to do with email that fails those checks, and sends you reports.

Google and Yahoo have required SPF and DKIM for senders since 2024, with DMARC required for bulk senders, and Microsoft introduced similar requirements for Outlook.com in 2025. Setting these up improves deliverability as well as security. Start DMARC in monitoring mode (p=none), review the reports, then move to quarantine and reject.

Train your team

Most email attacks rely on someone clicking a link or paying a changed bank account. Agree a simple rule: any change to payment details is confirmed by phone using a number you already hold.

What about Cyber Essentials?

Cyber Essentials is the UK government-backed certification covering five basic controls: firewalls, secure configuration, user access control, malware protection and security update management. It is often required for government contracts and increasingly requested by larger customers.

The requirements were updated in April 2026 (the “Danzell” question set). According to IASME, failing to use MFA where a cloud service offers it is now an automatic fail, and high-risk or critical updates must be applied within 14 days. If you are certifying for the first time, check the current requirements rather than older guides.

A 30-minute security check you can do today

Visit your site with http:// - does it redirect to https://?
Log in to your CMS - are there updates waiting?
Check MFA is on for email, hosting and your domain registrar.
Look up your domain's DMARC record with a free online checker.
Confirm when your last backup ran - and where it is stored.

If any of these raise questions, our hosting and maintenance plans cover updates, backups, monitoring and email authentication set-up.

Sources and further reading

Written by

Eirmon Solutions Editorial Team

Web, SEO and marketing team

Practical guides on web design, SEO, AI and digital marketing from the Eirmon Solutions team, written for UK business owners and checked against the sources listed with each article.