The 7 website security gaps we see most in UK small businesses (2026)
Cyber attacks on UK businesses are not rare events. The UK Government's Cyber Security Breaches Survey 2025/2026 found that 43% of businesses experienced a cyber breach or attack in the previous 12 months, and among smaller firms the figure was 42%. The single most common — and most disruptive — type of attack was phishing, reported by 38% of all businesses and rated the most damaging by 69% of those affected.
What that national picture hides is how attackers get a foothold. When we run Solvbeat's free scan across small-business websites, the same handful of gaps come up again and again — and most of them are quick and cheap to close. Here are the seven we flag most often, why they matter, and how to fix each one.
1. No protection against email spoofing (DMARC, SPF, DKIM)
This is the gap that ties directly to the #1 threat. Without an enforced DMARC record (backed by SPF and DKIM), anyone can send email that looks like it comes from your domain — the exact mechanism behind fake-invoice and supplier-payment fraud. We see far more domains with a missing or "p=none" DMARC policy than with a proper enforcing one.
Fix: publish SPF and DKIM, then add a DMARC record and move it to p=quarantine or p=reject once you've confirmed legitimate mail passes. It's free and it directly undercuts phishing that impersonates you.
2. Missing HTTP security headers
Headers like Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy are among the most commonly absent items we find. Their absence makes clickjacking, content-type confusion and some cross-site scripting attacks easier.
Fix: add the headers at your web server or CDN. Start with a report-only Content-Security-Policy so you don't break the site, then tighten it.
3. Outdated software with known vulnerabilities
Old versions of JavaScript libraries, CMS plugins and server frameworks frequently map to published CVEs — vulnerabilities with public, ready-made exploits. A scan often turns up a front-end library years out of date, or a server banner advertising an unpatched version.
Fix: keep a simple inventory of what your site runs, enable automatic updates where you can, and prioritise anything with a known CVE.
4. Exposed admin panels and sensitive paths
Login and admin interfaces reachable from the open internet — /wp-admin, /administrator, database tools, staging environments — are a standing invitation to brute-force and credential-stuffing attacks. We also routinely find robots.txt files that helpfully list the very paths a business hoped to hide.
Fix: restrict admin access by IP or VPN, enforce multi-factor authentication, and don't rely on robots.txt to hide anything — it's public.
5. Unnecessary open ports and services
Every internet-facing service is attack surface. Databases, remote-desktop and management ports left open to the world are a common finding, and they are exactly what automated scanners hunt for around the clock.
Fix: close anything that doesn't need to be public, put management interfaces behind a VPN, and review your firewall rules.
6. No HTTPS enforcement or weak transport security
Some sites still serve content over plain HTTP, don't redirect HTTP to HTTPS, or lack an HSTS header. That leaves visitors open to interception and downgrade attacks, and it quietly erodes trust and search ranking.
Fix: force HTTPS site-wide, redirect all HTTP traffic, and add an HSTS header once you're confident everything works over TLS.
7. Leaked internals: source maps, API endpoints and error detail
Published JavaScript source maps, hard-coded API endpoints in page source, and verbose error pages hand attackers a map of how your application works. It's information you never meant to publish.
Fix: strip source maps from production builds, keep secrets and internal endpoints out of client-side code, and return generic error pages.
The pattern: basics beat sophistication
None of these seven is exotic. They are the everyday hygiene items that the Cyber Essentials scheme is built around — and getting them right is what separates a business that shrugs off a phishing wave from one that becomes a statistic. The good news in the Government's survey is that cyber hygiene among small businesses is slowly improving; the bad news is that attackers only need one of the gaps above to be open.
Check your own site in under a minute
You can see where your website stands right now with a free Solvbeat scan — no login and no card. It runs passive, non-intrusive checks for all seven issues above (and more), and gives you a plain-English report ranked by risk, mapped to the UK Cyber Essentials controls. If you want to go further, we also offer deeper active testing and can prepare you for Cyber Essentials certification, which is issued via an accredited body.
Source: UK Government, Cyber Security Breaches Survey 2025/2026. Prevalence figures are from that survey; the recurring website gaps described are the issues Solvbeat's own scans most commonly flag.