Todmorden Small Business Website & Digital Health Checklist

01 / GUIDE

1. Know who owns the accounts your business depends on

Write down who controls the domain name, DNS, hosting, website administrator account, business email, Google Business Profile, analytics and any payment, booking or marketing systems connected to the website. The important point is not just knowing the supplier name; the business should know which login owns the account, which email address receives recovery messages and who can regain access if the usual person is unavailable.

Avoid leaving essential services tied only to a former employee, a freelancer's personal account or an email address nobody checks. Use business-controlled accounts where possible, enable multi-factor authentication, keep recovery details current and record renewal dates. If a supplier manages something on your behalf, make sure you still know what is registered in your name and what happens if you change provider.

02 / GUIDE

2. Check that you can recover, not just that you have a backup

A backup is useful only if it contains the right data and can be restored. Check what is backed up, how often it runs, how long copies are retained and whether the backup sits somewhere separate from the live website. For an important business site, a copy that disappears with the same hosting account is not a strong recovery plan.

Periodically confirm that a restore route actually works. The UK National Cyber Security Centre recommends backing up the data an organisation needs to operate and checking that it can be restored. Its small-organisation backup guidance is a useful independent starting point.

03 / GUIDE

3. Keep the website and administrator accounts maintained

For WordPress and similar systems, review core software, plugins, themes and the underlying PHP or application runtime. Updates should be controlled rather than ignored indefinitely or installed blindly on a busy production site. Remove unused extensions and administrator accounts, use strong unique passwords, enable multi-factor authentication where available and keep HTTPS certificates valid.

Look for signs that the website is unhealthy: unexpected redirects, unfamiliar administrator users, warnings from browsers or search engines, sudden performance changes, broken layouts after an update or repeated login attempts. The NCSC small organisations guide to cyber security covers account security, devices, backups and spotting attacks in practical terms.

04 / GUIDE

4. Treat domain, DNS and email as business infrastructure

Many website problems are actually domain or DNS problems. Check that the domain renews to an address the business controls, that nameservers are intentional and that nobody has added old or unexplained DNS records. Record where the DNS is hosted so a future website or email change does not become a guessing exercise.

For business email, confirm that the correct MX records are in place and that SPF, DKIM and DMARC are configured appropriately for the systems that send mail for the domain. Keep role addresses such as enquiries or accounts monitored, and know which platform is responsible for normal mailbox delivery versus newsletters, transactional mail or automated website messages.

05 / GUIDE

5. Test the customer journey from a phone

Open the website on a normal mobile connection rather than only on office Wi-Fi. Can a new customer understand what the business does, find the right service, read the text comfortably and take the next step without zooming or hunting through menus? Test the main contact form, telephone link, email link, booking flow and checkout if there is one.

Check the basics that quietly damage trust when they go stale: opening hours, service descriptions, prices where published, staff details, legal business name, contact information and photographs. A site can be technically online while still being commercially broken if the enquiry form no longer delivers mail or the most important information is out of date.

06 / GUIDE

6. Keep local business information consistent and real

For a Todmorden business that serves local customers, compare the business name, address or service area, telephone number, website and opening information across the website, Google Business Profile and legitimate local listings. Use the real trading information rather than adding keywords to the business name or inventing locations.

Google's Business Profile guidelines say businesses should represent themselves consistently in the real world and use an accurate location or service area. Useful local visibility comes from accurate information, good service, reviews, genuine local relationships and relevant mentions, not fake offices or mass directory submissions. PluginPip's local SEO guide explains the wider approach.

07 / GUIDE

7. Check privacy, forms and cookies

List the personal information the website collects through contact forms, accounts, ecommerce, analytics, newsletter sign-ups and third-party tools. Make sure the business has a privacy notice that reflects what actually happens to that data, and review whether non-essential cookies or tracking are handled appropriately.

The Information Commissioner's Office says organisations processing personal data generally need to provide privacy information, and its current small-organisation privacy and cookies guidance explains the basics. Keep forms proportionate: collect what the business needs, protect it and avoid leaving old exports or customer data sitting indefinitely in forgotten systems.

08 / GUIDE

8. Run a 20-minute monthly digital health check

Once a month, test one enquiry from the website, confirm the backup system has completed, review pending software updates, check domain and certificate expiry, look for obvious website errors, verify key Google Business Profile information and make sure important mailbox addresses still receive mail. Record anything that needs follow-up instead of relying on memory.

Bring in technical help when access is unclear, backups cannot be restored, security warnings appear, DNS or email authentication is uncertain, the website repeatedly breaks after updates, performance has become poor or an important customer journey fails. A short diagnosis is usually cheaper and safer than making random production changes. PluginPip is based in Todmorden; the Todmorden service page explains the website and business-technology support available locally.

09 / GUIDE

A simple record to keep

Keep one small business-controlled record containing: domain registrar, DNS provider, hosting provider, website platform, mailbox provider, backup location, Google Business Profile owner, analytics owner, renewal dates, recovery contacts and the person responsible for each system. Do not store passwords in an ordinary shared document; use an appropriate password manager and record only where access is managed.

This checklist is written for small businesses in Todmorden and the Calder Valley, but the same operational principles apply to most UK small organisations. It is deliberately a maintenance checklist rather than a sales specification: if everything is healthy, the correct action may simply be to document it and leave it alone.