Security
Cyber Essentials 2026: MFA is now mandatory
Cyber Essentials made multi-factor authentication compulsory in April 2026. What that means for a small business website and who really needs the certificate.
6 min read
Services
Website security
Your site stays online and taking enquiries, and a bad day means restoring a backup rather than rebuilding.
The essentials come with the monthly management from the second year.
What it gets you
- The site keeps taking enquiries, stays up, and stays yours
- A bad day is a restore from backup rather than a rebuild from memory
- Google never shows your customers a red warning page
- You hear about a problem from me, and I am already working on it
What this could do for you
A few examples of what it could look like for a business like yours. Ideas, not promises.
No "Not secure" warning
Customers never see a browser warning that makes them think twice about filling in your form or paying.
A bad day, quickly undone
With tested backups, a broken or hacked site is restored rather than rebuilt, so you are back to taking enquiries quickly.
Customer details kept safe
Sensible logins and regular updates keep the enquiries and orders your customers trust you with out of the wrong hands.
Why it matters
A website only earns its keep while it is there, loading properly, and taking enquiries. Small business sites are rarely attacked for what they hold: they are found by a script, filled with spam links or knocked offline, and the owner hears about it from a customer. The work that prevents that is dull and cheap by comparison: install the security updates, keep a backup you have actually tested, lock the doors, and agree who does what on the day something breaks anyway.
When not to buy this
- Your site runs on a hosted page builder whose company already updates it and backs it up for you.
- You already take the monthly management, which covers the essentials from the second year.
Who it is for
A few of the businesses this is built for, what it is costing them today, and what changes.
| Your business | Today | With this in place |
|---|---|---|
| A shop whose site was built years ago | Nothing has been updated since launch, and nobody would notice if the site went down. | Updates happen on a schedule, and a problem reaches you before it reaches a customer. |
| A garage taking bookings through a form | Junk submissions bury the inbox, so genuine enquiries get missed or answered days late. | Real enquiries arrive readable, and the form still takes a customer seconds to fill in. |
| A salon with one shared website login | The password sits in a group chat, and staff who have left still know it. | Everyone has their own login, checked with a phone code, and leavers lose access that day. |
| A letting agent with no tested backup | If the site broke, pages would be rebuilt from memory and whatever survived in old emails. | A copy kept off the server, restored on purpose to prove it works, brings the site back. |
What you get, and what it means for your business
| What you get | What it means for you |
|---|---|
| Security updates on a schedule | The most common way a small site gets broken is closed before anyone comes looking for it. |
| Backups off the server, tested | A bad day costs you a restore and an afternoon, not a rebuild and a fresh bill. |
| A padlock that never lapses | Customers see a padlock rather than a browser warning telling them to go back. |
| Spam and bot defence on forms | Enquiries you can actually read, without a puzzle that makes genuine customers give up. |
| Round-the-clock checks and a plan | You learn the site is down from me, and the order of the fix is already agreed. |
What is included
- Security updates installed regularly, for the site and everything it runs on, so known weak spots are closed before an automated attack finds them
- The padlock in the address bar kept on, with its certificate renewed automatically, so customers never see a "Not secure" warning
- Backups kept off the server and tested by restoring one, so a bad day has a known ending
- Spam and bot defence on every form, so real enquiries stay readable and real customers face no puzzle
- Sensible logins: strong passwords, a code from your phone when you sign in, and no shared accounts, so someone who leaves does not keep access
- The site checked around the clock, and an agreed plan for when something breaks, so nobody is deciding in a panic
Questions
Why would anyone attack a small business website?
Almost nobody targets you personally. Automated scripts scan the whole internet for software with known weak spots that has not been updated, and a site that has not been updated in two years is found by one within days. It is weather, not malice.
Is the monthly management the same thing as security?
It covers most of it: security updates, the padlock, backups and round-the-clock checks are all part of the monthly cost, so the essentials are handled without a separate bill. Work beyond that is quoted as its own job: recovering a hacked site, cleaning out spam pages, tightening up logins.
My site has already been hacked. Can you help?
Yes, and quickly is better than tidily: get in touch the same day. The usual order is take a copy, clean or restore, close the way in, then tell Google the site is safe again.
Related reading
Security
Musselburgh businesses: a website security check
A plain security check for a Musselburgh business website: the padlock, updates, backups, logins and who owns the web address. Most of it you can do yourself.
5 min read
Security
WordPress security updates: is your site patched?
Check your WordPress version, confirm the September security fix and update safely without paying for work your host has already done.
6 min read