Website security is one of three things that rarely get fixed until something goes wrong, alongside accessibility and actually using the data your site is already collecting. Design, speed and mobile-friendliness get most of the attention when people talk about business websites, and rightly so, but this second tier matters just as much. None of them are glamorous. All of them cost you if you ignore them.

Key takeaways

  • Website security isn't just for sites that take payments, an unpatched plugin can get hijacked whether you sell anything or not.
  • An SSL certificate, up-to-date software and backups that actually run cover most of the basics.
  • Alt text, keyboard navigation and colour contrast are the accessibility fixes with the biggest impact for the least effort.
  • Tackle security, accessibility and analytics one at a time rather than all in the same week.

Website security padlock icon overlaid on a browser window, representing basic site protection

Website security isn't just for sites that take payments

If you don't sell anything online, it's tempting to assume website security doesn't apply to you. It still does. An unpatched WordPress plugin or an outdated theme can be hijacked to serve spam or malware through your site without you noticing for weeks. Once Google flags a site as compromised, recovering your rankings takes far longer than the fix itself would have. The National Cyber Security Centre's small business guide covers the basics in plain English, since roughly one in two small businesses face a cyber incident every year.

The basics are genuinely simple: an SSL certificate (most hosts include this for free now), software kept up to date, and backups that actually run rather than ones you assume are running. If you handle any customer data at all, even just an enquiry form, you also need to be straightforward about what happens to that data once it's submitted.

What "backups that actually run" really means

Most hosting plans claim to include backups, and plenty of site owners assume that's sorted and never check again. The only way to know a backup actually works is to restore from it once, not just see a backup file listed in a dashboard. A backup that's never been tested is a guess, not a safety net, worth doing at least once when the site's set up, and again after any major change: a redesign, a new plugin, a platform migration.

Where they're stored matters too. A backup sitting on the same server as the site it's protecting doesn't help if that server is the thing that fails or gets compromised. Most decent hosts offer off-site or downloadable backup options, it's worth confirming yours does rather than assuming.

Website accessibility is worth doing properly, not performatively

Alt text on images, a site that can be navigated by keyboard, enough colour contrast to actually read the text, these aren't box-ticking extras, they're the difference between a visitor with a visual impairment being able to use your site or giving up and going to a competitor. It also happens to overlap heavily with good SEO: descriptive alt text helps Google understand your images the same way it helps a screen reader describe them (our on-page SEO techniques guide covers alt text along with the rest of it).

You don't need to overhaul everything at once, because fixing image alt text and checking your colour contrast is an afternoon's work and covers most of the practical impact.

Website accessibility and the law

For UK public sector websites, yes, the Public Sector Bodies Accessibility Regulations set a clear WCAG 2.2 AA standard. For a private small business, it's less clear-cut. The Equality Act 2010 requires reasonable adjustments for disabled people in the provision of services generally, and that's been argued to extend to websites, but there's no single fixed technical standard a small business site is required to hit the way a public sector one is. WCAG 2.1 AA is widely treated as best practice regardless. That grey area is exactly why it's worth treating accessibility as a genuine reason rather than a legal tick-box either way, a site that's hard to use with a screen reader is losing real visitors and enquiries whether or not a regulation technically applies to it.

Analytics is only useful if you actually look at it

Most sites already have Google Analytics installed. It quietly collects data nobody ever opens, which is a waste. The answers to genuinely useful questions are usually sitting right there: which pages people land on, where they give up, which page finally gets them to enquire (our guide to measuring SEO performance covers what to actually look at). You don't need to become a data analyst, because looking at it once a month, for ten minutes, is enough to catch a page that's quietly underperforming. Otherwise it costs you months of missed enquiries.

None of this needs to happen all at once

Trying to fix security, accessibility and analytics tracking in the same week you're also relaunching your site is a good way to do all three badly. Pick one. Sort it properly, then move to the next. Our technical SEO fixes guide follows the same one-thing-at-a-time order, if you want a place to start. A site that's slowly and properly maintained will always beat one that gets a frantic overhaul every three years, since that's usually when something finally breaks.

Frequently asked questions

Do I really need an SSL certificate if I don't sell anything online?

Yes. Browsers now flag any site without one as "not secure," which costs you visitor trust regardless of whether you take payments. Most hosts include one for free, so there's rarely a reason to go without.

How often should I actually check my analytics?

Once a month, for about ten minutes, is enough for most small business sites. The goal is catching a page that's quietly underperforming, not obsessing over daily numbers that are mostly noise.

What's the fastest accessibility fix with the biggest impact?

Alt text on your images. It's quick to do, it helps visitors using screen readers, and it helps Google understand your images too, one afternoon's work with a benefit in two directions at once.