A report from the British Chambers of Commerce found that 42% of UK businesses experienced some form of crime in the past year, with 21% reporting cyber attacks specifically and 20% reporting fraud or scams. The BCC calls this a "serious barrier" to growth. And it's not just big corporations being targeted. Small businesses are often easier targets because they typically have fewer protections in place.
If you run a small business or therapy practice, this might feel a bit alarming. But here's the good news: you don't need to become a tech expert or spend thousands to protect yourself. A few sensible steps can make a real difference.
Why Small Businesses Get Targeted
You might think hackers only go after big companies with deep pockets. Actually, the opposite is often true.
Small businesses are attractive targets because:
- They often use simple passwords (or the same password everywhere)
- Their websites may not have been updated in years
- They store customer data: emails, phone numbers, sometimes payment details
- They're less likely to notice an attack quickly
A hacker doesn't need to steal millions. If they can grab a few hundred email addresses from a therapist's booking system, that's valuable. Those emails get sold, used for phishing scams, or held for ransom.
The government's Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a cyber security breach or attack in the past 12 months, and that phishing remains by far the most common type. Micro and small businesses were somewhat less likely to be hit than medium and large ones, but still faced it regularly.
The Most Common Threats (In Plain English)
Phishing emails. These are fake emails pretending to be from your bank, HMRC, or a supplier. They trick you into clicking a link and entering your password. They're getting better and harder to spot.
Hacked websites. A significant share of small business sites run on WordPress, which powers roughly 40% of all websites. That popularity makes it a common target: if your site hasn't been updated, hackers can get in through known security holes in the core software, themes, or plugins. They might redirect your visitors to dodgy sites, or install malware that steals information.
Payment fraud. Someone pretends to be a supplier and asks you to pay an invoice to a new bank account. Or they intercept a genuine invoice and change the payment details.
Ransomware. Malicious software that locks your files until you pay. This used to target big companies, but increasingly hits small ones too.
Seven Practical Steps to Protect Your Business
None of these require technical knowledge. All of them help.
1. Use Different Passwords for Everything
I know, I know. It's annoying. But if someone gets your email password and you use the same one for your website, your bank, and your booking system, they've got the lot.
A password manager remembers everything for you and creates strong passwords automatically. Bitwarden has a free plan, and paid options like 1Password start at a few dollars a month for an individual account.
2. Turn On Two-Factor Authentication
This means you need your phone as well as your password to log in. Even if someone steals your password, they can't get in without your phone.
Set this up for your email first. Then your website. Then your bank. It takes a few minutes per account.
3. Keep Your Website Updated
If you have a WordPress site, it needs regular updates: the core software, your theme, and any plugins. Old, unpatched websites are how most small business hacks happen.
If you're not sure how to do this, ask whoever built your site, or look into a maintenance plan. Plenty of companies offer these, and what you should expect from one is worth understanding properly.
4. Back Up Your Website
If the worst happens and your site gets hacked, a recent backup means you can restore it quickly instead of starting from scratch. Your hosting company may do this automatically; check with them.
5. Use HTTPS (The Padlock)
Your website address should start with https://, not http://. This encrypts data between your visitors and your site. Most hosting companies offer free SSL certificates now. If your site doesn't have the padlock, ask your host or web designer to fix it.
6. Be Suspicious of Urgent Requests
If you get an email asking you to urgently transfer money, change payment details, or click a link, stop. Check by phoning the person directly using a number you already have, not one from the email.
This goes double for anything claiming to be from HMRC, your bank, or Companies House.
7. Train Your Team (Even If It's Just You)
Most successful attacks rely on human error. Someone clicks a link they shouldn't. Someone enters a password on a fake site. Spending 20 minutes reading about common scams makes you much harder to fool.
The National Cyber Security Centre has free guidance written in plain English for small organisations.
What If Something Goes Wrong?
If you think you've been hacked or scammed:
- Change your passwords immediately (starting with email)
- Contact your bank if money is involved
- Report it to Report Fraud, the service that replaced Action Fraud in December 2025
- Tell your web designer or hosting company if your website is affected
Don't be embarrassed. These scams are sophisticated and catch smart people every day.
The Bottom Line
You don't need to be paranoid. But you do need to be sensible. A few hours spent on basic security now could save you weeks of stress and a good deal of money later.
Start with passwords and two-factor authentication this week. Check your website is updated. Be sceptical of urgent requests. That covers most of the job.
Want a website that's built for you and then kept up for you? Elite Rose Digital sets up websites for small UK businesses from £249, then looks after them from £49 a month (12-month minimum). Tell us what you need at eliterose.digital.