Security for a small business website is three jobs, not a project. Keep the software current, prove the backups work, and stop weak logins. Each one costs less than an hour a month, and together they stop most of the attacks that actually happen. The alternative is an average bill of £1,600 for the worst breach you have all year, plus whatever trust you lose with it. Here is the case for doing the three jobs, with the numbers, and the monthly checklist at the end.
Who actually gets hit
The UK government runs the Cyber Security Breaches Survey every year, and the 2025 edition is the closest thing to a straight answer on who gets attacked. Just over four in ten UK businesses, about 612,000 of them, reported a breach or attack in the previous twelve months. That is down from 50% the year before, mostly because fewer micro businesses are falling for phishing, but it is still a coin flip.
The average cost of the most disruptive breach was £1,600 per business. Exclude the businesses that reported the damage as zero and the average jumps to £3,550. Both figures are what businesses admitted to, so treat them as the floor, not the ceiling.
Phishing is the single most common attack, named by 85% of businesses that had any breach. A single staff member clicking one link is the usual entrance, and half of that problem is solved by the login protections in the third section below.
What a hack actually costs
The cleaning bill is the shocker, because it arrives at the worst possible time, when the site is down. Recovery services quote in these bands: a simple infection removal runs £300 to £800, a complex infection where the hacker planted backdoors runs £800 to £2,500, and a full rebuild after a catastrophic compromise runs £2,000 to £12,000. Emergency call out alone, before any removal work, usually starts at £100 an hour.
| Job | Typical cost |
|---|---|
| Simple malware removal | £300 to £800 |
| Complex cleanup, backdoors in files | £800 to £2,500 |
| Full site rebuild after a bad one | £2,000 to £12,000+ |
| Emergency developer call out | £100+ per hour |
| Google blacklist removal, managed | £200 to £600 |
| Forensics to find how they got in | £500 to £1,500 |
Then Google gets involved. A site flagged as compromised shows visitors a warning page, and studies put the share of visitors who click through anyway at 5%. Traffic typically drops 70% to 95% overnight, and the average small business does not notice the breach for 11 days. By the time the warning is removed and rankings come back, you have spent a month earning back what you lost.
Job one: updates
The most common way in is not a genius hacking through a bank vault door. It is a bot scanning the internet for known flaws in old software, and the flaw is usually in a plugin or theme sitting at a version from two years ago. A patched system is not impregnable, it is just not the door everybody else has already walked through.
The fix is boring: update the core system, the plugins, the theme. Most content management systems offer automatic updates of core and often plugins; switch them on if your platform allows it, or put a monthly reminder in the diary. If your developer handles updates, ask how they alert you when one goes in. If the answer is “we sort it”, find out what that means in months, because the gap between months is the window.
Job two: backups
The hack is not the worst part. The worst part is finding out the backup is a folder on the same server that got infected, or a backup that has never actually been tested, and discovering both at the moment you need them.
The survey says 71% of businesses back up their data securely, which is a good headline and a bad detail: the useful questions are whether the backup is offsite and whether anyone has practised restoring it. The answer to the second question is usually no, and that is the whole point. A restore that has been tested once is a plan. A restore that has never been tested is a hope.
| Backup question | What a good answer looks like |
|---|---|
| Where is the backup stored? | Offsite, separate from the site |
| How recent can it get? | Daily at most, with old copies kept |
| When was a restore last tested? | In writing, dated, within the last 6 months |
| Who rebuilds the site from scratch? | Someone nameable, with access |
Managed hosting often includes daily backups with one click restore. That is worth money, and worth a look.
Job three: logins
Two factor authentication, a second check beyond a password, is the single cheapest lock on the back door, and the survey found only 40% of UK businesses use it. That means more than half are one password away. If passwords are shared between staff, or reused from a personal account that leaked, the door is open.
The good news is the fix is small. Turn on two factor everywhere it is offered or enforced by your host and admin accounts. Give each staff member their own login; never share one account. Remove logins for staff who left, and change the one you gave a freelance developer years ago.
Every small business site I have seen cleaned up gets hit through one of three doors: old plugins, an untested backup, or a password that was already public. Do the three jobs, and the most likely hacks simply no longer go through. An attacker spots an updated, backed up, locked down site and moves to the next one.
The monthly check
You do not need a security team. You need a repeating calendar entry with three boxes.
| Check | How long | What you are looking for |
|---|---|---|
| Updates | 5 to 10 minutes | No pending plugin, theme or core updates |
| Backup | 10 to 15 minutes | Backup ran yesterday, and you can name the restore procedure |
| Logins | 5 minutes | Two factor everywhere, no shared account, no leavers’ access |
Do that on the first Monday of the month, in writing, and you beat half the businesses the survey counts. If the questions about your own hosting are ones you cannot answer, that is not ignorance you should fix by reading more articles. Ask your web person, host or developer for written answers, and if they cannot give the monthly test date, treat that as your answer about how supported your site actually is.
The three jobs are the boring part of owning a website, and boring is the entire point. Do them, and the fancy parts of security, the firewalls and scans, get to sit beside a door that is actually closed.