Website Security Checklist for UK Businesses: Cyber Essentials Basics

The Short Answer

Cyber Essentials is a UK scheme, backed by the National Cyber Security Centre, that sets out five basic technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Applying them to your website and servers stops the majority of common attacks. This guide uses them as a checklist and does not replace formal certification.

1. Firewalls

Only open the network ports you need. A web server normally needs ports for HTTP, HTTPS and secure shell for administration, and little else.

Use the firewall on your server, and consider a web application firewall for public sites. Restrict administration access to known addresses where you can.

2. Secure Configuration

Remove default accounts and sample content, change default passwords and switch off services you do not use. Use HTTPS everywhere, and disable old protocols.

Keep a record of how each server is set up so you can rebuild it quickly and spot unexpected changes.

3. User Access Control

Give each person their own account, with only the access they need. Use strong, unique passwords with a password manager, and turn on two-factor authentication for hosting, email, your content system and your code repository.

Remove accounts as soon as someone leaves or a project ends.

4. Malware Protection

Scan your site and server for malware, restrict what can be uploaded and only install plugins and themes from trusted sources. Remove ones you no longer use.

Back up regularly and test restoring a backup, so you can recover quickly if something gets through.

5. Security Update Management

Apply updates to the operating system, web server, database, content management system and plugins promptly, especially security fixes. Old, unpatched software is one of the most common ways websites are compromised.

Turn on automatic updates where it is safe to, and schedule a regular time to check the rest.

Where Your Hosting Provider Fits

On a managed hosting plan, the provider normally looks after the server-level controls such as the firewall, operating system updates and monitoring. You remain responsible for your own application, accounts and content.

webzworld managed VPS plans include server management, a firewall, SSL and daily off-site backups, so your team can concentrate on the application layer. We do not claim certification on your behalf, and you should check what your own customers or contracts require.

Frequently Asked Questions

Do I need Cyber Essentials certification?

It is not compulsory for most businesses, but some contracts, particularly with the public sector, ask for it. The controls are worth following either way.

Is a managed host enough to be secure?

It covers the server, but your application, passwords and plugins still need attention.

How often should I review security?

A short monthly check of updates, users and backups, plus a deeper review once a year, works well for most small businesses.