Skip to main content

12 Days of Christmas

Twelve tips for your website, and for staying safe online.

Christmas is busy for small businesses, and it's busy for scammers too. Here are twelve plain-English tips: what to expect from whoever looks after your website, and how to spot the scams that turn up at this time of year.

Free to share with anyone who'd find them useful.

  1. Day 1

    Who owns your domain name?

    Your web address is the most valuable thing your website has. Check it's registered in your name or your business's name, not your web designer's. If they ever disappear, retire or fall out with you, you want to be able to move it without asking permission. A good developer will be happy to show you where it's registered and how to log in.

  2. Day 2

    The domain renewal letter that isn't

    Around this time of year, official-looking letters and emails arrive warning that your domain is about to expire, with a payment link. Many are from companies you've never used, trying to transfer your domain to them at a high price. Before paying anything, check who your domain is actually registered with, or ask your web person. If in doubt, don't pay.

  3. Day 3

    Do you have your own logins?

    You should have, or be able to get, the logins for three things: your domain, your hosting, and your website's admin area. Keep them somewhere safe, such as a password manager. Your developer may look after the day-to-day, but it's your business, and you shouldn't be locked out of it.

  4. Day 4

    "Please update our bank details"

    One of the most expensive scams for small businesses: an email that looks like it's from a supplier, asking you to pay their next invoice into a new account. Often the supplier's email has been hacked, so it really does come from their address. Always phone them on a number you already have, not one in the email, before changing any bank details.

  5. Day 5

    Ask about backups

    Ask your web person three questions. Is my website backed up? How often? And has anyone ever tried restoring it? A backup nobody has tested is a hope, not a plan. Good answers sound like "every night, kept somewhere separate, and I test a restore regularly."

  6. Day 6

    The "Microsoft" email

    Emails pretending to be from Microsoft, Google, your bank or your email provider ask you to "verify your account" or say "your mailbox is full". The link goes to a fake login page that steals your password. Don't click the link. Go to the real website yourself, by typing the address or using your bookmark, and check there.

  7. Day 7

    Is anyone updating your website?

    Websites need regular updates, just like your phone. Out-of-date software is the most common way small business sites get hacked. Ask whoever looks after yours: who updates it, how often, and would you know if something went wrong? If the answer is "nobody", that's worth sorting in the new year.

  8. Day 8

    "We'll get you to number one on Google"

    If you have a website, you'll get these emails: guaranteed first-page rankings, cheap SEO, "we noticed problems with your site". Nobody can guarantee a Google ranking, and the businesses who send these rarely do good work. Delete them. Good search results come from a useful website, real reviews and a properly set up Google Business Profile.

  9. Day 9

    Turn on two-step login

    If you only do one thing from this list, turn on two-step login (sometimes called 2FA) for your business email. Even if someone gets your password, they can't get in without the code from your phone. Your email is the key to everything else, because it's where every password reset goes. It takes five minutes.

  10. Day 10

    What a fair website deal looks like

    Before you sign up with any web designer, check a few things. You own the website and the domain once it's paid for. You can take it elsewhere if you need to. The price is agreed before work starts. And there's no long contract you can't get out of. Anyone confident in their work won't need to lock you in.

  11. Day 11

    The parcel text

    "Your parcel couldn't be delivered, pay a small fee to rebook." These texts peak at Christmas and the payment page steals your card details. Couriers don't ask for redelivery fees by text. If you're expecting something, check with the courier or shop directly, using their app or website, never the link in the message.

  12. Day 12

    Christmas opening hours

    An easy win. Update your Christmas and New Year opening hours on your website and your Google Business Profile, so customers don't turn up to a closed door. Google lets you add special hours for bank holidays. Then switch off, enjoy Christmas, and have a very happy new year.

Want more?

If you're thinking about a new website in the new year, start with the free plain-English checklist of what a small business website actually needs. Questions about any of these tips? Get in touch, I'm happy to help.