Website security advice is dominated by enterprise frameworks (NIST, ISO 27001) that assume security teams, SOC tooling and budgets UK SMBs do not have. The pragmatic SMB question is different — what are the highest-leverage moves that prevent the actual attacks UK SMB sites face, at SMB-realistic cost and operational overhead. This guide covers the eight areas where most SMB compromises happen, and the cheap-or-free measures that prevent them.
What UK SMB sites actually get attacked through
Three honest attack categories cover the vast majority of UK SMB website compromises in 2026. (1) Outdated WordPress plugins and themes — by far the largest single source of UK SMB site compromises; plugins with known vulnerabilities exploited by automated scanners. (2) Weak or reused admin credentials — admin passwords reused across services, leaked in unrelated breaches, exploited via credential-stuffing. (3) Form-based attacks — contact forms abused for email spam relay, lead-form databases extracted via SQL injection or similar input-validation failures. Sophisticated targeted attacks (nation-state, advanced persistent threat) are vanishingly rare against UK SMBs; the threat model is opportunistic automated exploitation of known vulnerabilities, not bespoke attacks.
1. HTTPS everywhere with proper certificate management
HTTPS has been baseline-required since 2014 (Google ranking signal since 2014, browser warnings since 2018, Chrome marking HTTP sites as "Not Secure" since 2018). In 2026 every site must serve HTTPS-everywhere with valid TLS certificates. The practical pattern: free Let’s Encrypt certificates with automatic renewal (handled natively by Vercel, Cloudflare Pages, Netlify, most managed WordPress hosts), HSTS header to force HTTPS connection, redirect HTTP to HTTPS at the host level, no mixed-content warnings (any subresource — images, scripts, stylesheets — must also load over HTTPS).
2. Security headers
A small set of HTTP security headers protects against most common browser-side attacks. (1) Content-Security-Policy (CSP) — restricts which sources scripts, styles and resources can load from, preventing most XSS attacks. (2) Strict-Transport-Security (HSTS) — forces HTTPS for the domain. (3) X-Content-Type-Options: nosniff — prevents MIME-type confusion attacks. (4) Referrer-Policy: strict-origin-when-cross-origin — limits referrer leakage. (5) Permissions-Policy — restricts which browser features (camera, microphone, geolocation) the page can request. Implementation: typically through host configuration (Vercel headers config, Cloudflare Page Rules, Netlify _headers file). Free, takes 30-60 minutes to implement, prevents a meaningful class of attacks.
3. Dependency management — the single biggest SMB attack surface
For WordPress and other plugin-driven sites, outdated plugins and themes are the largest single source of UK SMB compromises in 2026. The pattern: a plugin used by 100,000 sites has a vulnerability discovered, the vulnerability is publicly disclosed, automated scanners search the web for vulnerable plugin versions, sites that have not patched within 24-72 hours are compromised. The mitigation: weekly automated plugin updates with off-site backup, removal of unused plugins (every installed plugin is an attack surface even if not actively used), preference for plugins from major maintainers with active update history, monitoring of WPScan vulnerability database for installed plugins. For static-site architectures (Next.js, Astro, custom builds), the equivalent is npm dependency management — Dependabot or Renovate to flag dependency updates, regular security audits via npm audit.
4. Authentication on admin interfaces
Admin credentials are the second-most-common compromise vector. The mitigation: strong unique passwords per service (password manager required, not optional — 1Password, Bitwarden, Dashlane); two-factor authentication on admin interfaces (mandatory on WordPress, GitHub, Vercel, hosting providers, registrar, email provider); restricted admin URL paths (changing /wp-admin to a non-standard path reduces automated attack volume by 90%+); rate limiting on login attempts; IP-restricted admin access where the business has stable office IP ranges. Each of these is free or low-cost and prevents a meaningful percentage of compromise attempts.
5. Secure form handling
Forms are the third-most-common compromise vector. Two specific risks. (1) Spam relay — contact forms abused to send spam through the site’s email domain, damaging deliverability. (2) Database extraction via input-validation failures — lead-form databases extracted through SQL injection or similar. Mitigations: server-side input validation (never trust client-side validation alone); rate limiting on form submissions (5-10 submissions per IP per hour is typical); CAPTCHA on forms where automated submission is a real risk (reCAPTCHA v3 typical, or Cloudflare Turnstile for privacy-friendly alternative); parameterised database queries (the standard defence against SQL injection); restricted database permissions (the application user should not have admin database rights).
6. Regular backups with restoration testing
Backups protect against everything from ransomware to accidental deletion to plugin-update breakage. The pattern that works: automated daily backups, off-site storage (not on the same server as the live site), tested restoration (the most-skipped step — a backup that has never been restored may not actually work). For WordPress: managed backup plugins (UpdraftPlus, BackupBuddy, BlogVault, ManageWP) or host-level backup (most managed WordPress hosts include this). For static sites: git is the backup (git history is the version control plus backup), with additional database backups for any dynamic content. Restoration test: quarterly, restore the most recent backup to a staging environment and verify the site works.
7. Monitoring for compromise
Detection is the security control most SMBs skip. The minimal monitoring: uptime monitoring (UptimeRobot free tier, Better Stack, Pingdom — alerts when the site goes down which can indicate compromise or downtime); SSL certificate monitoring (alerts before certificates expire); security plugin scanning for WordPress (Wordfence, Sucuri, iThemes Security — flag file changes and known-malware patterns); Google Search Console security issues report (Google flags compromised sites here, often before the SMB notices); domain reputation monitoring (sites added to spam blacklists indicate compromise). Free or low-cost monitoring catches most compromises within 24-72 hours of occurrence rather than weeks.
8. Incident response readiness
When (not if) a compromise occurs, having a basic incident response plan accelerates recovery dramatically. The minimum plan: who is the named technical contact (the person with admin access who responds first); where are the backups (location, access credentials, restoration process); what is the immediate isolation step (taking the site offline via host control panel, removing DNS, etc.); who notifies whom (customers if PII compromised — UK GDPR requires 72-hour notification to ICO, legal counsel, payment processor if commerce affected); how is the root cause investigated (log review, backup comparison, what changed). A one-page incident response plan saved in the team’s shared documentation is worth more than no plan; UK SMBs without any plan typically lose days of response time figuring out what to do.
What about Cyber Essentials?
Cyber Essentials is the UK government-backed certification scheme covering basic cyber security controls. Cyber Essentials (self-assessment) costs £300-£500 and covers basic technical controls. Cyber Essentials Plus (independently audited) costs £1,500-£3,500 and is required for some government contracts. For UK SMBs without specific contract requirements, the certification value is moderate — the controls covered are largely the same as the eight areas in this guide, and the certification itself does not substantially affect ranking or customer trust outside specific procurement contexts. Worth pursuing if government contracts are a target market; not essential otherwise.
Cost of doing nothing
UK ICO data shows the median small-business compromise costs roughly 60-120 hours of management time to remediate, plus typically £2,000-£15,000 in direct costs (incident response, customer notification, lost business). For sites with material customer-data exposure, the costs scale higher. The eight measures in this guide together cost approximately 8-16 hours of initial setup time and 2-4 hours per month of ongoing maintenance — substantially less expensive than experiencing the average compromise.