Website security services for UK small businesses

Almost nobody targets a small business website on purpose. Automated scanners crawl millions of sites a day looking for an out-of-date plug-in, a guessable admin password or a forgotten /old-site/ folder, and they break into whatever they find. What follows is rarely dramatic: spam pages for knock-off trainers appear in Google under your domain, mobile visitors get redirected to a scam, a card skimmer sits quietly in your checkout, or your email starts landing in spam because your server has been sending junk.

Our website security service is for UK businesses that want those risks dealt with by developers who can actually fix the code, not just hand over a PDF of findings. We look after WordPress sites, WooCommerce shops and custom web applications for businesses anywhere from Cornwall to Aberdeen, from our base in London.

How big is the risk, honestly?

The UK government’s Cyber Security Breaches Survey, published each year by DSIT, has consistently found that a large share of UK businesses (roughly four in ten or more in recent editions) report a breach or attack in the previous twelve months, with phishing by far the most common. Website compromises are a smaller slice, but they’re the slice we see most often, and nearly all of them come through the same few doors:

• plug-ins or themes that haven’t been updated in months, or were abandoned by their authors years ago;
• admin accounts with weak or reused passwords and no two-factor authentication;
• old copies of the site, staging folders and database dumps left on the live server;
• cheap shared hosting where one compromised neighbour can affect everyone;
• ex-staff and old agencies who still have logins nobody remembered to remove.

None of that needs expensive tools to fix. It needs someone to look, then a routine.

What our security service covers

• Security review of your site or app: software versions, plug-ins, user accounts and roles, forms, file uploads, exposed files and hosting configuration, written up in plain English and ranked by risk.
• WordPress and WooCommerce hardening: removing unused plug-ins and themes, locking down the admin area, enforcing strong passwords and two-factor authentication, disabling file editing from the dashboard.
• Cloudflare set-up with a web application firewall, bot protection and rate limiting on logins, forms and checkout.
• Patching routine for WordPress core, plug-ins, frameworks and server packages, tested on staging first.
• Off-site backups with a restore we have actually tested. A backup nobody has restored is a hope, not a backup.
• Hacked site clean-up: removing malicious code, finding and closing the way in, and requesting removal from Google and email blacklists.
• Secure code review of custom Laravel, PHP and Node applications: authentication, permissions, input handling and dependency vulnerabilities.
• Email authentication (SPF, DKIM and DMARC) so criminals can’t easily send invoices that look as if they came from you.

What we’re not

We’re developers, not a penetration-testing firm or a 24/7 security operations centre. If an insurer, a large client or a tender requires a formal penetration test, it should be done by an independent tester with recognised accreditation such as CREST. We’ll help you scope it so you don’t pay for testing you don’t need, then fix whatever the report finds. Our guide to website penetration testing in the UK explains what a test covers and roughly what it costs.

We also don’t do office IT: laptops, Microsoft 365 tenants, firewalls in your server cupboard. A managed IT provider is the right partner there, and we’re happy to work alongside them.

How we work

Review

We start with read-only access to your site, hosting and DNS. Within a few days you get a short report: what we found, how serious each item is, and how long each fix takes.

Fix the urgent items

Out-of-date software, exposed admin areas, stray backup files and missing off-site backups are usually sorted in the first session.

Put routines in place

Most security is boring routine: updates every month, monitoring, and removing access when people leave. We set that up and, if you prefer, run it for you from a block of hours.

Plan for a bad day

You get a one-page incident plan: who to call, how to take the site offline safely, how to restore, and when you may need to tell the ICO and your customers.

UK GDPR, the ICO and Cyber Essentials

If your site collects personal data, UK GDPR requires appropriate security for it. A personal data breach that poses a risk to people generally has to be reported to the ICO within 72 hours of you becoming aware of it, so knowing quickly matters. Many suppliers to councils, the NHS and larger companies are also asked for Cyber Essentials, the government-backed scheme run by IASME. We can bring your website, hosting and related accounts up to the standard it expects; the certification itself is assessed by an approved certification body.

What website security costs

Security work is booked as hours that never expire. Straightforward WordPress sites are billed at our WordPress development rate of £50 an hour; custom applications at £60 an hour. All prices exclude VAT.

Compare that with the cost of a hacked shop: lost sales while it’s offline, card details potentially exposed, and Google warning visitors away from your domain for days. A few hundred pounds of prevention is cheap.

If you’ve been hacked right now

Call us on 020 3918 3814. Don’t start deleting files or restoring old backups yet, because that can destroy the evidence of how they got in and leave the hole open. We’ll tell you what to do first, before any work is agreed.

Get your site checked

Send us your website address and tell us what it runs on. We’ll tell you what we’d check and what it would cost. Contact us, or see how ongoing care fits with our infrastructure management service.