Keeping a small firm's website running

A business website needs looking after for as long as it is live.

These notes gather the routine tasks from official UK guidance for small organisations. They also cover where AI tools can help, and where a person checks the work.

Back up the website with everything else

The National Cyber Security Centre (NCSC) advises small organisations to back up all the data they need to operate. It names the company website alongside emails, invoices and customer details.

The NCSC suggests two backups, one online and one on a separate device, in case one is lost or fails. Keep the storage device unplugged when it is not in use. Once a backup exists, find out how to restore it and check it holds everything you need.

Look after the logins

The NCSC lists the company website, and the domain hosting account if it is separate, among the accounts a business relies on. It recommends passkeys where a service offers them. Otherwise, use a strong password that is unique to the account, with 2-step verification turned on.

Over time, staff, suppliers and contractors collect accounts. The NCSC notes that these often stay active after people leave, without anyone noticing. It suggests reviewing who has access every few months and removing anyone who no longer needs it.

Keep the software up to date

Updates fix bugs that criminals could use to break in. The NCSC advises keeping software and apps up to date, and deleting what you no longer use. If a piece of software no longer gets updates, it suggests finding a supported alternative.

Cyber Essentials is the minimum standard of cyber security that the government recommends. It is a certification built on five technical controls. A growing number of organisations require suppliers to hold it before they bid for work.

The details the law expects on the site

A limited company must show its registered number on its website. It must also say where it is registered, such as England and Wales, and make clear that it is a limited company.

Cookies need care too. The Information Commissioner's Office (ICO) says a business must tell visitors what its cookies do and get their consent. Cookies that are essential to a service the visitor asked for are the exception. Non-essential cookies should wait until the visitor has agreed.

If the business starts using cookies in a new way, it may need to ask again.

Where AI tools fit

Generative AI tools can produce text, images and video, which makes them useful for drafting pages. The NCSC notes that they can also get things wrong and state errors as facts. They can be biased, and attackers can trick them with crafted input, which the NCSC calls prompt injection.

Before an AI-written page goes live, a person reads it. Any change an AI tool proposes to the site itself needs a person's approval too. The NCSC also suggests deciding who in the business is responsible for the security of the AI tools you use.