The ten checks
1. Is there a padlock?
Open your website and look at the address bar. You should see a padlock or similar symbol, and the address should start with https. Then type your address with http:// in front: it should switch to https on its own. If it does not, ask whoever looks after your site to fix it. Browsers now warn visitors away from sites without it.
2. Is the software up to date?
If your site runs on WordPress or a similar system, log in and look for update notices for the system, the theme and the plugins. Out-of-date plugins are the most common way small business websites get hacked. Delete any plugins you no longer use, rather than just switching them off.
3. Are the important logins protected?
Four accounts matter most: your website admin, your hosting, your domain registrar (where you pay for your web address) and your email. Each should have its own long password, ideally kept in a password manager, and two-step verification switched on, so a stolen password alone is not enough.
4. Who still has access?
Look at the user list on your website, hosting and email. Remove former staff, old web designers and any account you do not recognise. Everyone left should have only the access they need.
5. Are there backups, and do they work?
Ask your host or web designer: how often is the site backed up, where are the backups kept, and when was one last restored to check it works? A backup kept only on the same server can be lost with the site.
6. Will your web address renew?
If your domain lapses, your website and email stop working, and someone else can buy the name. Log in to your registrar and check that auto-renew is on, the payment card is current, and the account email is one you still read.
7. Can someone send email pretending to be you?
Three settings called SPF, DKIM and DMARC tell other email providers which emails from your address are genuine. Without them, scammers can send convincing emails to your customers in your name. The National Cyber Security Centre has a free email security check: type in your domain and it tells you what is missing.
8. What do your forms collect?
Contact and booking forms should ask only for what you need, and never for card details sent by email. If a form fills your inbox with spam, it needs protection added.
9. Has your email been in a data breach?
Type your business email addresses into Have I Been Pwned. If they appear in a breach, change the password on that account and anywhere else you used the same one.
10. What does Google show for your site?
Search Google for site: followed by your web address, with no space (for example site:yourbusiness.co.uk). Look through the results for pages you did not create, odd languages or adverts for things you do not sell. Those are signs a site has been hacked.
If something looks wrong
- Change the passwords on the affected accounts first, from a device you trust, and switch on two-step verification.
- Tell your host or web designer straight away; most hosts can restore a clean backup.
- Forward suspicious emails to report@phishing.gov.uk, the National Cyber Security Centre’s reporting service.
- For a wider plan, the National Cyber Security Centre’s Small Business Guide is free and written for non-technical owners. If you want a recognised standard, look at Cyber Essentials.
Rather someone checked it for you? Our cybersecurity support covers all ten of these and more: we check your website and email setup, explain what we find in plain English, and give you a short, ordered list of what to fix.