Getting your small business website right

A small business can put up its own website with an online builder that sets up the pages for it.

Whoever made the pages, the business that owns the site is the one responsible for what it says and how it treats visitors. These notes walk through the steps UK law and official guidance ask for, so the site works well for you and for the people who visit it.

Your domain name

The person or business named on a domain registration is called the registrant. ICANN looks after the rules for names such as .com. It says registrants can see their registration agreement at any time. They are also entitled to clear instructions on renewing and transferring the name.

If a builder registered the name for you, ask whose name is on the registration. Registrants have to keep their contact details accurate and reply to their registrar within 15 days.

You have the right to move a domain to another registrar. A registrar may refuse a transfer within 60 days of the first registration. It may also refuse within 60 days of a change to the registrant's name, organisation or email address.

Company details on the site

A limited company has to show some details on its website.

The company's registered number.
Its registered office address.
Where it is registered, such as England and Wales.
The fact that it is a limited company, usually by giving its full name with "Limited" or "Ltd".

If the site names any of the directors, it has to name all of them.

Cookies and visitors' data

A cookie is a small file that a website stores on a visitor's device. The Information Commission (which took over from the ICO on 30 September 2026) says you must tell visitors what your cookies do and why. You must also get their consent through a clear action, such as ticking a box.

Cookies that are strictly necessary for something the visitor asked for are exempt, such as a shopping basket. Other cookies can only be set after the visitor agrees.

A contact form or a mailing list collects personal data. When you collect it, you have to tell people why you want it, how long you will keep it and who you will share it with. Organisations that use personal information, sole traders included, pay a data protection fee to the Information Commission unless they are exempt.

Selling online

A business selling to customers at a distance has to give them certain information before they buy. That includes the business name and address, the full price with taxes, and the delivery costs and times. It also includes how to cancel.

Customers can cancel up to 14 days after their order is delivered, without giving a reason. If you never tell them about that right, they can cancel at any time in the next 12 months.

Making the site accessible

The Web Content Accessibility Guidelines (WCAG) are the international standard for accessible web content. The latest version, WCAG 2.2, has 13 guidelines. Each one has success criteria at three levels, called A, AA and AAA.

The W3C's Easy Checks give a quick first look at any page. They cover page titles, headings, colour contrast, keyboard focus, zoom and descriptions of images. The W3C says they cover only a few issues, so a full review goes further.

Keeping it secure

The National Cyber Security Centre (NCSC) has a guide for small organisations. It covers backups, protecting devices and accounts, and spotting scams. The NCSC says many of its steps take as little as five minutes.