Most small business owners do not think about website security until something goes wrong.
A security warning appears in a browser. Enquiries slow to nothing. A customer mentions they could not reach the site. Sometimes the problem has been there for weeks before anyone noticed.
The good news is that for most small business websites, security is not complicated. There are five things that matter more than anything else — and if your hosting is set up properly, most of them should already be in place.
This is not a technical audit for IT teams. It is a plain-English check for business owners who want to know whether their website and email setup is doing its job.
What this checklist covers
- SSL certificate — active and redirecting correctly
- Email authentication — SPF, DKIM and DMARC are set
- Backups — running daily and tested
- CMS and plugins — kept up to date
- Admin login — strong password with 2FA where possible
Work through each one in order. The first three are the most important.
1. SSL certificate — active and redirecting correctly
Why it matters
SSL is what puts the padlock in your browser address bar and makes your web address start with https:// rather than http://. Without it, browsers show visitors a "Not Secure" warning before they even see your homepage.
That warning loses you enquiries. Visitors see it and leave. Google also uses HTTPS as a ranking signal, so a missing or broken SSL certificate can quietly cost you search visibility too.
In 2026, SSL should come included with any reputable hosting plan. The question is not whether you have one — it is whether it is working correctly.
A broken redirect is one of the most common SSL problems. The certificate is installed, but the old http:// address still loads without the warning. Anyone who visits the http version sees the "Not Secure" message even though the secure version exists.
How to check
Type your website address into a browser using http:// at the start (not https://). Watch whether the page automatically redirects to the secure version. If it does, you are fine. If it loads without redirecting — or shows a warning — the redirect needs correcting.
You can also use a free tool called SSL Labs to check your certificate in more detail. It will flag any configuration problems.
Find out what SSL covers for UK small businesses →
2. Email authentication — SPF, DKIM and DMARC are set
Why it matters
Email authentication records are DNS settings that tell the world's mail servers that your email is genuinely coming from you.
Without them, your emails are far more likely to land in spam. More seriously, other people can send email pretending to be you — and mail servers will have no way to check whether it is real.
SPF, DKIM and DMARC are the three records involved. If they are missing or misconfigured, customers may never receive your invoices, quotes, or enquiry replies. They might be getting them — just not in their inbox.
This matters more than most business owners realise. A missing SPF record does not produce a visible error. It just quietly reduces deliverability until someone mentions they have not been receiving your emails.
How to check
Log in to your Eazyhosting Control Panel and check your DNS records for your domain. You are looking for an SPF record (which starts v=spf1), DKIM records, and a DMARC record (which starts v=DMARC1).
If you are not sure how to read DNS records, your hosting provider should be able to confirm these are set correctly for you.
Full guide to SPF, DKIM and DMARC →
Do UK small businesses need a DMARC service? We explain what DMARC does and when you need extra help →
Business email compromise and invoice scams
Email authentication is also one of the simplest defences against business email compromise: scams where someone pretends to be your business, a supplier, or a member of staff to redirect payments or trick customers into trusting a fake message.
SPF, DKIM and DMARC will not stop every scam email, but they make it harder for someone to spoof your domain successfully. They also give receiving mail servers a clearer signal when a message claiming to come from your business is not legitimate.
For small businesses, the practical rule is simple: if your domain sends invoices, quotes, order confirmations, password resets, or customer support replies, email authentication is part of your website security setup, not a separate technical extra.
3. Backups — running daily and tested
Why it matters
A backup is only useful if it works when you need it.
Most hosting plans include automated backups. The problem is that business owners often assume they are running without checking. Then something goes wrong — a plugin breaks the site, a file gets corrupted, or an update causes an error — and the backup turns out to be weeks old, or was never running at all.
For a small business website, daily backups are the right frequency. They mean that if something breaks, you are restoring to yesterday rather than last month.
The second part of this check is just as important: confirm a restore actually works. A backup you cannot restore from is not a backup.
How to check
Log in to your Eazyhosting Control Panel and open Timeline Backups. Check when the most recent backup was taken. If it is from today or yesterday, the automated backups are running. If the most recent one is older than a few days, something needs investigating.
You do not need to do a full restore to test. Most backup tools let you confirm that the backup file is intact and complete.
Full guide to website backups for UK small businesses →
4. CMS and plugins — kept up to date
Why it matters
Outdated software is the most common reason small business websites get compromised.
When a vulnerability is discovered in WordPress, a theme, or a plugin, the fix is usually released quickly. But if you are running an old version, the vulnerability stays open — and once it is publicly known, automated tools can find and exploit it within hours.
You do not need to update everything every day. But checking once a week and applying available updates is one of the most straightforward things you can do to protect your site.
Updates sometimes break things. That is real, and worth knowing about. The safest approach is to run a backup before updating — which is why checks 3 and 4 go together.
How to check
If you are using WordPress, log in to your admin dashboard. The Updates section shows available updates for WordPress itself, your theme, and your plugins. Apply them in order: WordPress core first, then plugins.
If a plugin update has ever broken your site, take a backup first and update one plugin at a time.
What to do if a WordPress update breaks your site →
5. Admin login — strong password with 2FA where possible
Why it matters
Automated tools try to log in to WordPress sites constantly. They try common usernames like "admin" and large lists of common passwords. If your admin account uses a weak password or the default username, it is only a matter of time before one of those attempts succeeds.
A strong password does not need to be hard to remember. The National Cyber Security Centre recommends three random words strung together — something like RedCloudSatchel — because they are long enough to be secure and easier for a person to remember than a string of characters.
Two-factor authentication (2FA) adds another layer: even if someone has your password, they cannot log in without a second code. Most WordPress security plugins offer this, and it takes about five minutes to set up.
How to check
Log in to WordPress and check what your admin username is. If it is "admin", change it to something unique. Check when your password was last changed and whether it is genuinely strong.
If your site handles customer data or enquiries, set up 2FA on your admin account. Most reputable WordPress security plugins include it.
What your hosting should already be doing
Here is something worth knowing: a good hosting setup handles most of this automatically.
SSL should be included and configured from the start. Email authentication records should be set when your domain is connected. Daily backups should run without you having to think about it.
At Eazyhosting, these things are included as standard — not as add-ons you have to enable manually. If you are not sure whether any of the above is in place for your site, contact us and we can check the setup for you.
The purpose of this checklist is not to give you more things to manage. It is to help you confirm that what should already be working is working.
Summary — 5 things to check today
- SSL — visit your site with
http://and confirm it redirects tohttps:// - Email authentication — confirm SPF, DKIM and DMARC records are set in your DNS
- Backups — check Timeline Backups and confirm a recent backup exists
- Updates — log in to WordPress and apply any available updates
- Admin login — change "admin" username, use a strong password, enable 2FA
If you find something missing or are not sure how to check, Eazyhosting can help you work through it. Most of these are small fixes that make a significant difference to how well-protected your site and email are.
Published June 2026 · Eazyhosting — hosting, domains and email support for UK small businesses
