A compromised website isn't a tech problem. It's a business problem. Leaked customer data under GDPR triggers ICO fines of up to £17.5 million or 4% of global turnover. Even a small breach can take a UK SME weeks to recover from and carries an average cost of £8,460, according to UK government figures.
Most of it is preventable. Here's the practical 2026 security checklist for UK small business websites.
Why 2026 is different
Three shifts have made website security more urgent than ever:
- AI-powered bot attacks. Automated scanning tools test thousands of SME websites per day for known vulnerabilities. They're cheap to run and find victims fast.
- Stricter UK GDPR enforcement. The ICO issued £25.7 million in fines in 2025 alone. SMEs are no longer too small to be noticed.
- Google's security-first ranking. Sites without HTTPS, with known malware, or with exposed user data are demoted in search — sometimes permanently.
If you haven't reviewed your security posture in the last 12 months, you're behind.
Step 1: SSL / HTTPS is non-negotiable
Every UK business website in 2026 must serve traffic over HTTPS. That means a valid SSL certificate installed and auto-renewing (Let's Encrypt is free and standard), HTTP traffic automatically redirected to HTTPS, no "mixed content" warnings, and HSTS header enabled.
Test your setup at ssllabs.com/ssltest. Aim for grade A. If you're graded B or below, fix it this week.
Step 2: GDPR fundamentals on your website
UK GDPR applies to every business collecting customer data, which includes an email signup form.
Minimum requirements:
- Privacy Policy page — lists what you collect, why, how long, and who you share with.
- Cookie consent banner — a genuine opt-in, not a "by continuing you agree" dark pattern. Tools like CookieYes or Cookiebot do this for £6–£30/month.
- Contact form consent — a ticked-in-advance checkbox is NOT consent under UK GDPR. Users must actively opt in.
- Data processor agreements — if you use Mailchimp, Stripe, or similar, ensure you have DPAs in place.
- Breach notification plan — you have 72 hours to notify the ICO of a qualifying breach.
Step 3: Harden the platform
WordPress
WordPress powers 43% of the web and is the #1 target for attackers.
- Update core, themes and plugins weekly. Enable auto-updates for security patches.
- Remove unused plugins and themes entirely.
- Use a security plugin: Wordfence or Solid Security.
- Change the default /wp-admin login URL.
- Enforce strong passwords (12+ characters) for all users.
- Enable 2FA for every admin.
- Use a web application firewall (Wordfence or Cloudflare).
Shopify / Squarespace / Framer / Webflow
Platform security is handled for you. Focus on strong admin passwords and 2FA, limited staff access levels, and trusted apps only.
Custom / headless sites (Next.js, Astro, etc.)
Most security is handled by the host. Focus on environment variable hygiene (no secrets in the repo), Content Security Policy headers, and rate limiting on forms and APIs.
Step 4: Backups, the last line of defence
A hacked site is only a catastrophe if you don't have a working backup. Rules: daily automated backups (weekly isn't enough), stored off-site from the hosting provider, test restores monthly, retain 30 days minimum.
WordPress: UpdraftPlus (free) or BlogVault (£6/month). For custom sites, your host usually handles this.
Step 5: Monitoring and alerts
Set up UptimeRobot (free) for uptime monitoring, file integrity monitoring (Wordfence), Google Search Console alerts for malware flags, and SSL expiry alerts.
Common vulnerabilities we find in UK SME audits
- Outdated WordPress version (60% of audited sites).
- Abandoned contact form plugins with known XSS vulnerabilities.
- No backups, or backups on the same server.
- Default admin usernames ("admin", the owner's name).
- No 2FA on any user.
- Cookies setting before consent.
- Public .env files or database dumps left in the site root.
What to do if you're hacked
- Isolate immediately. Take the site offline (maintenance mode).
- Change every password — hosting, CMS, database, FTP, email.
- Scan and clean — use Sucuri, Wordfence, or hire a specialist.
- Restore from a clean backup if available.
- Notify the ICO within 72 hours if personal data was involved.
- Inform affected users per UK GDPR.
- Patch the vulnerability that allowed entry.
- Review Google Search Console for malware flags and request a review after cleaning.
Frequently Asked Questions
Do I need SSL if I only have a brochure site? Yes. Google flags non-HTTPS sites as "Not Secure" in Chrome, tanking trust and rankings.
How often should I update my website? WordPress: weekly for security patches, monthly for plugin updates. Custom sites: dependencies reviewed quarterly.
Does my SaaS (Shopify, Framer) need GDPR compliance on the website? Yes. Platform security is separate from GDPR obligations.
What's the single highest-impact security improvement? Enabling 2FA on all admin accounts.
The bottom line
Website security is no longer optional for UK SMEs. The combination of AI-driven attacks, stricter GDPR enforcement, and Google's security-first ranking means every business needs a working baseline.
If you want a professional audit of your current site, get in touch. We offer this as part of our WordPress development and custom website services.
