Small business website checklist for 2027

What dates in 2027 matter for a small business website?

Four dated changes matter around 2027: Companies House identity checks, new rules for subscriptions, and two cuts to how long a website’s security certificate may last. Only the first two need anything from you.

Companies House began identity verification on 18 November 2025 with a 12-month transition. Existing directors verify with their next confirmation statement, and it will be an offence to act as a director without being verified once those duties commence. On 9 August 2026 the government said the new subscription rules “will now come into force in January 2027”. The regulations were still in draft when I wrote this.

Which rules already apply to my website?

Two sets of rules already apply: the ban on fake reviews since 6 April 2025, and the data law changes that began on 5 February 2026. The Digital Markets, Competition and Consumers Act bans fake reviews, and the CMA can fine up to 10% of global turnover. Write, buy or swap no reviews, and check the ones you show.

The Data (Use and Access) Act changed the rules for cookies, the small files a site stores on a visitor’s device. On 5 February 2026 the ICO said the Act gives it power to issue fines of up to £17.5 million or 4% of global turnover under PECR, the Privacy and Electronic Communications Regulations. I have not confirmed how that applies to a small site’s cookies. The ICO also said a requirement for a data complaints procedure was due to commence on 19 June 2026, so your privacy page should say how someone can complain to you.

The ICO lists cookies that need no consent: strictly necessary, statistical, appearance, communication and emergency assistance ones. Statistical cookies must use aggregated data, give clear information and offer a free, simple way to object. Advertising cookies never qualify. Ask your developer for a list of every cookie and tracking tool on your site.

What is changing with website security certificates?

Certificates will be valid for much shorter periods, so renewal has to be automatic. A security certificate is the digital proof behind the padlock in a browser, and it has an expiry date. The CA/Browser Forum, which sets the rules for them, allows 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029.

Let’s Encrypt, a free certificate provider, makes 64-day certificates its default from 10 February 2027 and 45 days from 16 February 2028. It warns that renewals hardcoded to a 60-day schedule will break. Ask your host whether renewal is automatic. A certificate renewed by hand would need renewing at least every 100 days by March 2027.

Does my website have to meet WCAG 2.2?

Only public sector websites must meet WCAG 2.2 AA by law; for a private business, the law asks for reasonable adjustments. WCAG, the Web Content Accessibility Guidelines, is the standard for accessible sites. Version 2.2 is a W3C Recommendation with nine new criteria. GOV.UK requires public sector sites to meet 2.2 AA. The Equality Act 2010 asks service providers to make reasonable adjustments for disabled customers, and a website can be part of that. I found no UK law that names WCAG for private firms.

In practice, ask your developer to check that text is readable, buttons are big enough to tap and the whole site works from a keyboard.

The small business website checklist

Work through these eight. Skip any that do not apply to you.

Related: How to test your enquiry form, What you get at launch