Is my website secure? An SSL and security checklist

Just over four in ten UK businesses (43%) reported a cyber security breach or attack in the last 12 months, which the government puts at roughly 612,000 businesses. Small firms aren’t spared: 42% of micro businesses and 46% of small ones were affected, against 65% of medium and 69% of large (DSIT and Home Office, Cyber security breaches survey 2025/2026, published 30 April 2026, retrieved 2026-10-11).

That survey covers every kind of incident, not just hacked websites, and phishing was the most common (38% of businesses). But the basics that protect a website are the same ones many owners never check, because security feels like a developer’s job. This checklist for small business websites has eight items. Each one comes with a way to see your current status in a few minutes.

Key Takeaways

• 43% of UK businesses reported a breach or attack in the last 12 months, and 46% of small businesses did (Cyber security breaches survey 2025/2026). Size isn’t protection.
• A missing padlock no longer tells you much. Chrome replaced it in 2023, so look for a “Not secure” warning, an http:// address that doesn’t redirect, or an expiry date that has passed.
• Software, logins and backups do most of the work: updates applied, two-step verification switched on, and a backup you’ve actually restored.
• Plugins are where the risk sits on WordPress. 91% of the vulnerabilities Patchstack tracked in 2025 were in plugins, and 46% had no fix when they were disclosed.
• Hosting covers the server. The site itself, its logins and its plugins are usually yours to look after.

#	Check	How to see where you stand	Time
1	Valid SSL certificate	Visit the https:// and http:// versions; read the expiry date	1 min
2	Software up to date	CMS dashboard updates page; PHP version in hosting panel	2 min
3	Two-step verification	Log out and back in to your CMS, hosting and email	2 min
4	Working backups	Find the latest backup and where it’s stored	2 min
5	Access review	Open the users list and read every name	3 min
6	Plugin check	Sort plugins by last update date	3 min
7	Reliable hosting	Ask your host four questions	5 min
8	A baseline	Open Search Console’s security issues report	2 min

1. Do you have a valid SSL certificate?

If your site loads over http:// or shows a “Not secure” warning, fix that first. Visitors see the warning before they see anything of yours, and anything they type into a form can be read on its way to your server.

An SSL certificate (strictly TLS these days, though everyone still says SSL) lets the visitor’s browser and your server encrypt the traffic between them. It’s what puts the “s” in https.

Quick check:

1. Type your address with https:// at the front. Any browser warning means the certificate is missing, expired or misconfigured.
2. Type the http:// version. It should jump to https:// by itself. If it stays on http, visitors can still land on the unencrypted site.
3. Click the icon at the left of the address bar, open the certificate details and read the expiry date.

Plenty of guides still tell you to look for a padlock. Google announced in 2023 that Chrome would replace the lock icon with a variant of its “tune” icon (Chromium Blog, “An update on the lock icon”, 2 May 2023, retrieved 2026-10-11). Chrome labels plain http sites “Not secure” in the address bar (Chrome Security, “HTTPS by default”, retrieved 2026-10-11), so that warning is the thing to look for. Keep in mind what a certificate does and doesn’t prove. It shows the connection is encrypted. It says nothing about whether the site has been hacked or the business is trustworthy.

The warning is about to get harder to ignore. Google’s Chrome team says that with Chrome 154 in October 2026, Chrome will enable “Always Use Secure Connections” for public sites by default, and “will ask for the user’s permission before the first access to any public site without HTTPS” (Chrome Security, “HTTPS by default”, 28 October 2025). A plain-http site then shows visitors a click-through warning page before they reach it.

Certificates are also getting shorter-lived. The maximum validity for public certificates is being cut in stages from 398 days to 47, between March 2026 and March 2029 (CA/Browser Forum, ballot SC-081v3, retrieved 2026-10-11). In practice that means renewals must be automatic. If renewing depends on someone remembering, one day it will lapse. Ask your host or developer whether yours renews itself.

If a certificate is missing, you probably don’t need to buy one. Let’s Encrypt says “anyone who owns a domain name can use Let’s Encrypt to obtain a trusted certificate at zero cost”, and many hosts and website builders switch it on for you. For a deeper check, run your domain through the free Qualys SSL Labs server test, which grades the configuration from A+ down to F.

2. Is your software actually up to date?

Check your updates page first, because attackers go after known flaws in outdated software, and “it’s working fine” doesn’t mean “it’s current”. If you only have time for one more check after SSL, make it this one.

The most detailed public data available is for WordPress, so that’s where these numbers are drawn from. Patchstack, a WordPress security company, logged 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on 2024. It says about half of high-impact vulnerabilities get exploited within 24 hours (Patchstack, State of WordPress security in 2026, retrieved 2026-10-11). Patchstack also notes attackers keep trying older vulnerabilities, which pay off on sites that haven’t updated.

The UK government’s survey suggests many businesses are slow here. Only 34% said they have a policy to apply software security updates within 14 days (Cyber security breaches survey 2025/2026, retrieved 2026-10-11). The NCSC’s advice for small organisations is to keep everything up to date and switch on automatic updates where you can, because updates fix bugs that criminals could otherwise use to hack your device (NCSC, Protecting your devices, retrieved 2026-10-11).

Quick check:

• Log in to your CMS and open its updates page. Anything waiting for weeks needs attention.
• Look at which PHP version your host runs (it’s usually in the hosting control panel). PHP is the language behind WordPress. As of 11 October 2026, php.net lists versions 8.2 to 8.5 as supported, and 8.2 reaches the end of its security support on 31 December 2026. Anything older isn’t on that list, so aim for 8.3 or later.
• Check that your theme and plugins still have an active developer (see item 6).

Using Wix, Squarespace or Shopify? The platform handles its own core updates, so this item shrinks to the apps, embeds and custom code you’ve added. Updating alone isn’t a complete defence, since Patchstack found 46% of vulnerabilities had no fix from the developer when they were disclosed. That’s why items 5 and 6 matter too. If an old site keeps falling behind on updates, it may also be one of the signs your website needs a redesign.

3. Do you have two-step verification switched on?

A stolen or guessed password shouldn’t be enough to get into your site, your hosting account or your email. Two-step verification (2SV, also called two-factor authentication) adds a second check, such as a code from an app, so a leaked password alone doesn’t work.

The NCSC says 2SV “keeps cyber criminals out of your accounts even if they know your passwords”, and that “any type of 2SV is better than none”. It puts email first, because “access to one inbox often gives access to other systems and sensitive information”, including resetting passwords elsewhere (NCSC, Secure your email, retrieved 2026-10-11). Phishing, which tricks people into handing over logins, was the most common type of attack in the survey, experienced by 38% of businesses. Meanwhile 47% said they use any form of two-factor authentication for networks or applications (Cyber security breaches survey 2025/2026).

Quick check: Log out of your CMS admin and back in. If nothing asked for a second step, it isn’t on. Do the same for your hosting account, your domain registrar and the email address those accounts reset to. Strong passwords still matter alongside it. The NCSC suggests combining three random words, or letting a password manager create and remember them (NCSC, Three random words, retrieved 2026-10-11). Where it’s offered, use passkeys. The NCSC advises enabling them “as a priority” where your email provider supports them. Otherwise use an authenticator app, which usually beats text-message codes.

4. Are your backups actually working?

A backup you’ve never restored is an assumption, not a safety net. It’s your last line of defence when an update breaks the site or someone gets in.

The NCSC tells small organisations to make a copy of “all the data that your business needs to operate”, and not to leave an external drive plugged in when it isn’t in use, because some malware spreads to connected devices (NCSC, Backing up your data, retrieved 2026-10-11). It also recommends knowing how to restore your backup and checking that it contains everything important. In the government survey, 74% of businesses said they back up securely via a cloud service and 48% by other means (Cyber security breaches survey 2025/2026).

For a website, that means the files and the database. A backup stored only in your hosting account can disappear along with the account if it’s compromised, so keep a copy somewhere separate.

Quick check: Find the date of your latest backup, who made it, how often it runs and where it’s stored. Then ask whether anyone has restored one, even onto a test copy of the site. If the answer is “I think so”, it’s worth doing this week.

5. Who has access, and do they still need it?

Every account that can log in is another way in, so remove anyone who no longer needs access. Former staff, past freelancers and agencies you stopped working with are the usual leftovers.

In the survey, 73% of businesses said they restrict IT admin and access rights to specific users (Cyber security breaches survey 2025/2026). The same habit applies to your site: most people who edit content don’t need to be administrators.

Quick check:

• Open your CMS users list and read every name. Does each person still work with you?
• Look at the role next to each. Editors and authors can’t change plugins or add users, so use those roles where you can.
• Avoid shared logins. If three people use one account, you can’t tell who did what, or remove one person without changing the password for all.
• Check who is listed on your hosting account, domain registrar and analytics, not just the CMS.

6. Are you vetting plugins and third-party tools?

Every plugin, app or embedded script is code you didn’t write, running on your site. Check how recently it was updated before you install it, and delete the ones you no longer use.

Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins, 9% were in themes and only six were in WordPress core. It also found 46% of vulnerabilities had no fix from the developer when they were disclosed (State of WordPress security in 2026). Most of the risk sits in the add-ons, not the platform. Other systems have the same pattern with their own extensions, apps and tag manager snippets.

Quick check: On WordPress, open your plugins list. For each one, ask three questions:

• Is it still being updated? On the plugin’s WordPress.org page, check “Last updated”. A plugin untouched for a year or more deserves suspicion.
• Do you still use it? Delete unused plugins rather than just deactivating them. Unused code adds exposure and no benefit.
• Does it do something another plugin already does? Fewer overlapping tools means fewer places to go wrong, and a faster site as well. Our guide to why a website is slow covers that side.

Don’t forget third-party scripts such as chat widgets, tracking pixels and booking embeds. Know who can add or change them.

7. Is your hosting provider reliable?

Cheap, unmanaged hosting is a security question as well as a speed one. A good host patches the server, monitors it and responds when something goes wrong. A poor one leaves you to do all of that yourself, or not at all.

The responsibility splits roughly like this. The host looks after the physical servers, the operating system and the server software. You look after what’s on top: the CMS, plugins, themes, passwords and users. Managed platforms such as Wix or Shopify take on more of that, and a bare shared hosting plan takes on less. Check your terms to see where your line is.

Ask your host four questions:

1. Who patches the server software, and how quickly?
2. Which PHP version are we on, and can we move to a supported one? (See item 2.)
3. Are backups included, how often, and can I restore them myself?
4. What happens if the site is hacked? Is there support, and at what hours?

If the answers are vague, or the plan is a few pounds a month with no support, that’s information. Security basics belong in the ongoing running costs, which we break down in what a website costs in the UK. If someone else built and looks after your site, ask whether security basics are included as standard.

8. Do you know what normal looks like for your site?

You can’t spot something wrong without a baseline. A little monitoring means you find out about a problem in hours instead of months, and it’s an item many small businesses skip.

Start with Google Search Console, which is free. Its security issues report covers hacked content, malware and unwanted software, and social engineering (Google Search Console Help, Security issues report, retrieved 2026-10-11). If you haven’t verified your site there, do it. It’s also where you’d see odd pages you never created.

Quick check: Open the security issues report. A green check mark means no issues were detected at the last check. Then search Google for site:yourdomain.com and scan the results for pages you don’t recognise, such as pills, loans or casino pages. Pages like these can be a sign the site has been hacked.

Add an uptime monitor next, so you hear about downtime before a customer tells you. UptimeRobot lists a free plan with 50 monitors on a 5-minute interval, though it describes that plan as “good for hobby and non-profit projects”, so check its terms for commercial use, or ask your host whether monitoring is included. Then set a monthly 10-minute routine: updates, users, plugins, Search Console. Nothing here needs technical depth, only a habit.

The short version

Website security is mostly a handful of checkable habits, not a one-off technical project. The highest-risk items (SSL, updates, backups) are also the quickest to check.

• Open your site on https:// and http://. Neither should show a warning, and http should redirect.
• Apply updates, delete unused plugins and check your PHP version.
• Switch on two-step verification for your CMS, hosting, registrar and email.
• Restore a backup at least once, and store a copy away from your host.
• Review users and roles. Remove anyone who doesn’t need access.
• Ask your host who patches what.
• Verify Search Console and set up uptime monitoring.

Work through the eight items in order. If you want a second pair of eyes, get in touch. For how security sits alongside speed, mobile usability and accessibility, our complete Core Web Vitals guide covers the full performance and trust picture.