Running your site

Website security for small Jersey businesses

Most attacks on small business websites are automated, not personal. A handful of basics stops most of them, and Jersey has free help on the island if something does go wrong.

By Josh, Web Designer, Developer & SEO Updated 30 September 2026 6 min read How we check our facts

Nobody is singling out a café in St Aubin or a plumber in St Saviour. Most attacks on small websites are automated: software scanning thousands of sites for an old plugin, a weak password or an admin page left open. That is good news, because the defences are also routine. Checked against the Jersey Cyber Security Centre and the UK’s National Cyber Security Centre in September 2026.

The basics that stop most attacks

Keep everything updated. Website software, plugins and themes. The Cyber Essentials standard expects critical security updates within 14 days; for a website, sooner is better.
Turn on two-factor sign-in everywhere it is offered: your website admin, hosting, domain registrar and email. A stolen password alone then gets nobody in.
Keep admin access small. One account per person, no shared logins, and old accounts removed when someone leaves.
Remove what you do not use. Every unused plugin or old test page is something that can go out of date.
Back up, and check the backups work. Kept somewhere separate from the site, so a problem on the server does not take the backup with it.
Protect the domain account. Whoever controls the domain controls your website and email. Make sure that account is in your name, with two-factor sign-in on.

Free help on the island: the Jersey Cyber Security Centre

The Jersey Cyber Security Centre (opens in a new tab) (JCSC) was set up in 2021 and runs at arm’s length from government. It is not a regulator. It gives free, confidential advice, and small businesses can book a free cyber advice session through its website.

Its Jersey Cyber Shield (opens in a new tab) service is free for any Jersey organisation and includes alerts about vulnerabilities that affect island businesses. Its business security controls guide (opens in a new tab) covers the same ground as the list above in more depth.

Cyber Essentials

Cyber Essentials (opens in a new tab) is the UK government-backed certificate for basic cyber security, and Jersey businesses can certify. The basic level starts at £320 plus VAT. Since 2020, suppliers on Government of Jersey contracts worth more than £25,000 have had to meet Cyber Essentials or an equivalent, so it is worth having if you bid for public work. For everyone else, the checklist is a sensible standard even without the certificate.

What about the new Cyber Security Law?

The Cyber Security (Jersey) Law was approved by the States Assembly in January 2026. Its mandatory incident reporting applies to operators of essential services, a defined list of critical sectors, not to ordinary small businesses. After the States vote it went for Privy Council approval, and the Minister sets the start date. See the JCSC’s information hub (opens in a new tab) for the latest. Unless you run essential services, it does not add duties for your website.

If something goes wrong

Report it to the JCSC: incidentreports@jcsc.je, phishing@jcsc.je for phishing, the form on its report an incident (opens in a new tab) page, or 01534 500050.
Tell whoever hosts your site, so they can isolate it and restore a clean backup.
Change passwords for the website, hosting, domain and email, starting with email, because password resets go there.
Think about personal data. If customer details may have been exposed, you may need to report it to the JOIC (opens in a new tab), and quickly. Ask them if you are unsure.

Where hosting fits

Much of this is the hosting company’s job, so ask what yours does. With Jersey Web, the hosting fee (from £20 a month) covers security, updates and backups, and there is a person to contact if something looks wrong. Whoever hosts you, you still own two jobs: strong, unique passwords with two-factor sign-in, and keeping the domain in your own name. Our guide to getting your website and domain back from an old designer covers the second.

New to some of these terms? Our Jargon Buster explains website and marketing language in plain English.