Musselburgh businesses: a website security check

Musselburgh calls itself the Honest Toun, and most of the businesses in it are exactly that: the High Street shops, the cafes and salons, the garages and yards, the trades who work out of a van across East Lothian, and the businesses around Fisherrow harbour and the racecourse. It is two miles along the coast from my desk in Portobello, close enough that I know a good few of those shopfronts by sight.

A lot of the websites behind those shopfronts were built a few years ago, by a nephew, a friend or a firm that has since moved on, and nobody has looked at them since. That is not a disaster. But it does mean some of them are quietly in worse shape than their owners think, and a short check now is far cheaper than a clean-up later.

Here is the check I would do on a Musselburgh business website, in the order I would do it. You can do most of it yourself in half an hour.

Is the padlock there?

Open your website on your phone and look at the address bar. You should see a small padlock, the sign that the connection between your customer and your site is private. If instead you see "Not secure", or a warning page before the site loads, fix that first.

That warning is the one problem customers actually notice. Somebody about to fill in your contact form or pay a deposit sees "Not secure" and stops. It is also usually the easiest problem to fix: the padlock comes from a small certificate that most hosting companies now provide free, and a site showing the warning has often just let it lapse.

When was the site last updated?

Most small business sites are built in a system that needs security updates, the same way your phone does. WordPress is the most common one. The system itself, its theme and every add-on that gives the site an extra feature all need updating every so often.

When they are not updated, the weaknesses in old versions become public, and automated software scans the internet looking for sites that still have them. Nobody is targeting your salon in particular. The software simply tries every site it can find.

If you can log in to the bit you edit your site in, look for a message saying updates are waiting. If there are dozens, or if you cannot remember the last time anybody logged in, that is your answer. I wrote a longer guide on checking whether your WordPress site is up to date if you want the detail.

Is there a backup, and has anybody tried it?

Ask whoever hosts your site two questions. Is there a backup? When was it last restored to check it works?

Most owners can answer the first one. Almost nobody can answer the second. A backup that has never been tested is a hope, not a backup. If your site is broken or hacked, a working backup means it is restored in an afternoon rather than rebuilt over weeks, and the difference to a business taking enquiries is enormous.

Who owns your web address?

This is the one that catches the most Musselburgh businesses, and it is not strictly a security problem until the day it becomes the worst one.

Your web address is registered to somebody. It should be you, or your business. Quite often it is the person who built the site, registered on their own account, renewed on their own card. If they move away, change their number or simply forget, the address lapses, your website and your email stop working, and somebody else can buy the name.

You can check who the registered owner is by asking your host, or by looking at the account you pay for it from. If the honest answer is "I am not sure", find out this week.

Who can log in?

Make a list of everyone who has a login to your website, your hosting and your email. Former staff, the person who built the site, an old marketing helper. Remove anybody who no longer needs access, and change the passwords that were shared.

Then turn on a code from your phone when you sign in, wherever it is offered. It is a small nuisance for you and a large obstacle for anybody who has guessed or stolen a password. If your site, your hosting or your email offers it and you have not switched it on, do that today.

Is the contact form sending spam?

A form that has been abused to send spam is a common sign of an old site. Look in your inbox for odd submissions in other languages or full of links. Ask your host whether the site has been sending unusual amounts of email. A form with no protection can also be used to send spam to other people in your name, which can get your own email blocked.

When you do not need much security work

The unwelcome part. If your site is a few pages that say what you do, with no logins, no payments and no customer details stored, it needs far less looking after than a shop or a booking site. Keep it updated, keep the padlock working, make sure you own the web address, and that is most of it. Do not let anybody sell you an expensive security package for a site that holds nothing worth stealing.

And if your site is on one of the big page builders like Squarespace or Wix, the platform handles a lot of the updates for you. Your jobs are the logins, the code from your phone, and owning the address. A security audit would mostly tell you what the platform already does.

Where the work matters is a site that takes bookings, payments or personal details, or an old site that has gone years without updates. That is when an hour of checking is worth a lot more than an hour.

Have it checked over a cup of tea

If you run a business in Musselburgh, Wallyford or Fisherrow and you would rather somebody else did this check, I am ten minutes along the coast and the first look is free. There is more on Musselburgh businesses and on what website security covers, including when it is not worth paying for. If your site is fine, I will tell you and leave it alone. Book a free consultation (opens in a new tab).