Website security costs for small businesses

Key takeaways

Website security for a UK small business typically costs £10 to £100 a month, covering updates, a firewall or security service, monitoring and backups, often within a care plan. Recovering from a hack commonly costs £500 to £3,000 or more, plus lost enquiries. The cheapest protection is keeping software updated and access tightly controlled.

• Updates and care: about £30 to £150 a month.
• Security service or firewall: about £0 to £30 a month.
• Hack clean-up: about £500 to £3,000 or more.
• Cyber Essentials: a few hundred pounds a year.

How much does website security cost?

Website security typically costs £10 to £100 a month for a small business site, based on common tools and care plans. That covers software updates, a web application firewall or security service, malware scanning, uptime monitoring and backups. Many care plans bundle these.

• Website security for small businesses: the basics
• How much does a business website cost in the UK?

What should a security budget cover first?

A small security budget should cover updates first, then strong logins with two-step verification, backups, and a firewall or security service. The NCSC small business guide puts updates, access control and backups ahead of more advanced tools.

• Software, theme and plugin updates.
• Strong passwords and two-step login.
• Tested backups.
• Firewall and malware scanning.

• Website backup costs: what proper backups need

What does a hack cost to fix?

A hacked small business site commonly costs £500 to £3,000 or more to clean, depending on damage and backups, plus lost enquiries while it is down and possible blacklisting by browsers. The government's breaches survey shows cyber attacks remain common for UK businesses.

Is Cyber Essentials worth it?

Cyber Essentials is a government-backed scheme covering basic controls across your IT, not just the website. Certification costs a few hundred pounds a year for small organisations and is required for some public contracts. It helps prove you take security seriously.

• Your website and public sector tenders: what buyers check

When can security cost less?

Security can cost less on hosted builders, which handle platform updates and security for you. You still need strong logins and to control who has access. Self-hosted WordPress sites need more active care.

• Paying a designer to build on Wix or Squarespace

What does this look like in practice?

At Global Bridge Labs (GBL), a UK recruitment agency's site was hacked through a plugin that had not been updated for a year. Clean-up and lost time cost about £2,200. Their care plan now costs £75 a month, including updates, a firewall and monitoring, and the site has been clean since.

• See client work
• Website Design & Development for UK businesses

Security cost checklist

• Keep all software updated.
• Use two-step login for every admin.
• Remove unused accounts and plugins.
• Run tested backups.
• Add a firewall or security service.
• Consider Cyber Essentials.

• Website backup costs: what proper backups need
• Annual website renewals small businesses forget

Next step

List everyone with admin access to your site. Remove anyone who no longer needs it and turn on two-step login for the rest.