Ryvx

You do not need a security team to close the most common gaps on a small business website. Work through these ten checks with whoever built or looks after your site. Most take minutes.

Accounts and access

1. Turn on two-step login everywhere it matters: your website admin, your hosting account and your domain registrar. Whoever controls the domain controls the website, so treat that login like your bank's.

2. Remove accounts nobody uses. Old staff, a past developer, an agency you stopped working with. Every forgotten login is a way in that nobody is watching.

3. Give people the lowest access that lets them do their job. Someone who writes blog posts does not need to install plugins.

Software

4. Keep your platform, theme and plugins up to date, and switch on automatic updates where your platform offers them. Attackers scan the whole internet for known holes in old versions within days of a fix being published.

5. Delete plugins and themes you are not using. Switching one off is not enough, because the files are still on the server.

Files and data

6. Check nothing private is sitting in a public folder. Backup files, database exports, old copies of the site and configuration files with passwords in them are a common find. If your developer uses version control, make sure its folder cannot be downloaded from the live site.

7. Take backups and test that you can restore one. A backup you have never restored is a guess.

The basics a browser can check

8. Use HTTPS on every page, with a certificate that renews on its own, and tell browsers to always use the secure version.

9. Set the security headers and cookie settings that stop other sites framing your pages, injecting scripts or reading your visitors' sessions.

10. Know which outside scripts load on your pages: chat widgets, analytics, ad tags. Each one runs with the same power as your own code, so remove any you no longer need.

Where to start

The free Ryvx website health check covers checks 8, 9 and 10 and part of 6: your certificate, security headers, cookies, outside scripts, and two of the files most often left public by mistake (a settings file and the version-control folder), explained in plain English. It is read-only, it runs once per account on a site you own, and it does not test your code or prove your site is secure.

When you want the site itself tested, a Ryvx Launch Security Review is £495 per site: our AI testing tools work through it like an attacker, every finding comes with proof, and a person checks the report before you see it.