Updated: 29 October, 2026
- 1. Protect the accounts that control your website
- 2. Use strong, unique passwords
- 3. Turn on 2-step verification
- 4. Give people only the access they need
- 5. Choose your web designer and host with care
- 6. Keep backups, and test that you can restore them
- 7. Look after personal data
- 8. Test, train and know what to do if it goes wrong
- A simple starting checklist
- Frequently asked questions
- Why would a hacker target a small business website?
- What is the single most useful security step?
- Do I need to be technical to improve my website security?
- What should I do if my website has been hacked?
- Is website security a legal requirement?
Website security can sound like a job for specialists, but much of it comes down to habits any business owner can adopt: protecting the accounts that control your site, choosing suppliers carefully, keeping copies of your data and knowing what to do if something goes wrong. This guide is for owners in Liverpool and Merseyside who run a website or online shop and want a plain-English starting point.
The UK's National Cyber Security Centre (NCSC) says small businesses are just as likely to face online crime as larger ones. It aims its small organisations guide at organisations with 0 to 49 employees, notes that many of its recommendations can be done in as little as five minutes, and stresses that you do not need to be a technical expert. No set of steps can make a site completely safe, but the ones below reduce the chance and the impact of a problem.
1. Protect the accounts that control your website
Most small business sites are reached through a handful of logins: your hosting account, your domain registrar, your content management system (the area where you edit pages) and your email. Whoever controls those controls your site. Make a list of them, and decide who in your business holds each one.
2. Use strong, unique passwords
The NCSC recommends three random words to make a password long enough and strong enough to resist guessing. It advises avoiding predictable choices such as significant dates, sports teams, and family or pet names, and says swapping letters for lookalike numbers or symbols does not meaningfully help. A password manager can generate and store strong passwords so you do not need to remember each one, and the NCSC says writing a password down is acceptable if you keep it somewhere safe. Use a different password for every account, so one leak does not open the rest.
3. Turn on 2-step verification
2-step verification (2SV, also called two-factor or multi-factor authentication) asks for a second step that only you can access, such as a code sent by text or created by an app. It protects an account even if someone learns your password. The NCSC advises turning it on for accounts that guard what you care about most, and for your email first, because criminals with access to your inbox can use it to reset passwords on your other accounts. Check whether your hosting, domain and website admin logins offer it.
4. Give people only the access they need
Do not share one login between several people. Give each person their own, with only the permissions they need, and remove access promptly when someone leaves or a freelancer finishes a project. The ICO's guidance on data security also says you should name someone with day-to-day responsibility for information security and give them the authority and resources to do the job. In a small firm that may be you.
5. Choose your web designer and host with care
Your site's security depends partly on the people who build and host it. Ask whoever builds your site:
Who looks after updates to the site's software, themes and plugins, and how often?
Where is the site hosted, and what protection does the host provide?
Who holds the admin logins, and what happens if you change supplier?
What is the plan if the site is hacked?
If your site uses a platform such as WordPress, ask who is responsible for keeping it, and any add-ons, current. Our guide to what a website builder is looks at the trade-offs between builders and bespoke sites.
6. Keep backups, and test that you can restore them
The NCSC's backup guidance says to copy all the data your business needs to operate, including your website, emails, invoicing, documents and customer information. Backups help if ransomware locks your files or a device is lost or stolen. It suggests keeping an online backup, protected with 2-step verification, and a copy on an external device kept in a secure place and disconnected when not in use, because some viruses also infect connected devices. After backing up, check you know how to restore the data and that the backup includes everything important.
7. Look after personal data
If your site collects names, emails or enquiries, UK GDPR applies to how you protect them. The ICO says the security principle requires "appropriate technical and organisational measures", but it does not prescribe specific controls: the measures should fit your circumstances and the risks. The ICO recommends assessing how sensitive your data is and the harm that could follow if it were compromised. It also recommends encrypting personal data you store or send over the internet, choosing suppliers that offer sufficient security guarantees, training staff to recognise phishing, and testing your measures regularly. It suggests the government's Cyber Essentials scheme as a sensible starting point. This is a summary of official guidance, not legal advice: for your own situation, check with the ICO or a solicitor.
8. Test, train and know what to do if it goes wrong
The ICO advises reviewing your measures regularly and acting on what you find. The NCSC says cyber security is everyone's business, so make sure anyone with access to your systems knows to be careful with unexpected emails and links. If you think you have been hacked, the NCSC points small organisations to its Response and Recover guidance, and if personal data is involved, the ICO has information on reporting a breach.
A simple starting checklist
List every account that controls your website, and who holds it.
Change weak or reused passwords and consider a password manager.
Turn on 2-step verification, starting with email.
Remove old logins for people who no longer need them.
Ask your web designer and host about updates and backups, in writing.
Keep a tested backup, with one copy stored separately.
If you would like a site built with these questions in mind, see our web design services or get in touch. It also helps to understand what a website costs so you can budget for ongoing care.
Frequently asked questions
Why would a hacker target a small business website?
The NCSC says small organisations are as likely as larger ones to face online crime. Criminals do not need to know your business: they look for accounts with weak passwords or no extra protection, and a small firm can be an easy way in.
What is the single most useful security step?
There is no single fix, but protecting your logins is a strong start: unique passwords, plus 2-step verification on your email and website accounts. The NCSC highlights email in particular, because it can be used to reset other passwords.
Do I need to be technical to improve my website security?
No. The NCSC says you do not need to be a technical expert to follow its small organisation guide. Your web designer or host should handle the technical side, and you can ask them clear questions about updates, backups and access.
What should I do if my website has been hacked?
Contact your web designer or host, and follow the NCSC's Response and Recover guidance. If personal data may have been exposed, check the ICO's guidance on reporting a breach, and consider speaking to a solicitor.
Is website security a legal requirement?
If you handle personal data, UK GDPR requires appropriate security for it, as the ICO explains. What counts as appropriate depends on your risks, so take advice for your own situation.
Related posts
