Security and legal on your website: the guide

The padlock, and what it does not guarantee

When I ask a client whether their site is secure, the answer is almost always the same: «yes, it has the little padlock». The padlock in the address bar means one thing. The connection is encrypted, so nobody in the middle can read what the visitor sends. It says nothing about what happens inside the site itself.

And inside is where most things happen. On sites built with WordPress, for example, according to a security company's annual report, 96% of the vulnerabilities published in 2024 were in plugins (small pieces of third-party software that add features), not in the core. So every plugin is a security decision. And note something everyone forgets: plugins do not update themselves by default.

What actually makes the difference is a short, unglamorous list: scheduled updates, fewer plugins, a second login factor on the accounts that can change the site, and backups that have been tested by restoring them. A backup that was never tested is not a backup, it is a hope. All of it, with sources, is in why the padlock in the address bar is not enough.

The encryption grade, and the A that does not tell the whole truth

There is a free test that grades how well your padlock is set up, from A+ to F. You can run it yourself in two minutes. The hard part is understanding what it tells you.

If you get a B, the most likely cause is simple: the server (the computer where the site is hosted) still accepts old versions of the encryption protocol, which browsers closed years ago. If you get an F, usually someone forgot to renew the certificate, the digital paper that proves the site is what it claims to be. And if you get an A, hold the celebration: an A can lack the protection that forces the browser to always use a secure connection (HSTS). That only counts towards A+.

And a change that affects you this year: since 15 March 2026 certificates live at most 200 days instead of 398, and the limit will keep falling. Renewal by calendar reminder is over, it has to be automatic. What each letter means and what to ask is in your site's SSL grade: what a B actually means.

When the site opens normally and something has broken

When a site goes down, you find out immediately. The worse case is when it opens normally and one part of it has stopped working: the search does nothing, the form never arrives, the checkout gets stuck. The visitor does not phone to tell you. They leave. And in your statistics it looks like a visit that simply did not buy.

It happened to me, twice within a few days, while trying to make my own site more secure. Both times the page opened perfectly well. So after every change, check five things as a customer would: the search, the form with a real submission, the basket if you sell, a file download if you offer one, and all of that on a phone. The two stories and the rule are in I changed one setting and broke my own site, without noticing.

The question for your provider here is a single one: does your monitoring only check that the site responds, or does it also test that it works? «It is up» and «it works» are two different things.

The emails that never arrive

«I sent the quote and the client says they never got it». We almost always find it in the recipient's spam folder. And it is almost never the wording. The problem is that your domain does not declare who is allowed to send email in your name. That is done with three records in the DNS, your domain's «phone book», called SPF, DKIM and DMARC.

Since February 2024 they are no longer optional. Google requires authentication from every sender, and extra requirements from anyone sending more than 5,000 messages a day to Gmail addresses. That threshold sounds high, but the basic requirements apply however few you send. There is also the legal side, which is a different matter: for advertising messages, article 11 of Greek law 3471/2006 requires prior explicit consent, with an exception when you obtained the address in a previous sale and the message concerns similar products or services, always with an easy way to unsubscribe in every message.

What the three mean, what exactly Google asks and what the law says, is in why your emails land in the spam folder. For your provider, the question is simple: «do we have SPF, DKIM and DMARC, and who reads the reports?».

Cookies and consent: the rule has been written since 2020

The most common mistake I see is the belief that cookies are governed by the GDPR alone. In Greece they are also governed by article 4(5) of law 3471/2006, which requires consent for anything stored on or read from the visitor's device, whether or not it is personal data. So «I do not collect personal data, I do not need a banner» does not hold.

The Greek Data Protection Authority wrote it plainly in Recommendations 1/2020. Google Analytics needs consent. Rejecting must take the same number of clicks and sit on the same level as accepting. Scrolling the page is not consent. And the GDPR adds something that fails almost everywhere: you must be able to prove the visitor consented. A nice banner that keeps no record does not cover you.

An eight-point check you can do yourself, with no technical knowledge, and what is being proposed to change in Europe (a proposal, not an adopted law), are in GDPR and cookies in 2026: what actually applies to a Greek website. The proof gap is exactly what MS-Consent, our own consent tool, is built to close.

Accessibility: an obligation for some, a gain for everyone

Since 28 June 2025 the European Accessibility Act has applied, transposed in Greece by law 4994/2022. Accessibility means the site can be used by someone who sees less, does not use a mouse, or listens to the page through a screen reader. The obligation does not cover every site. It covers specific services, with e-commerce first on the list. Microenterprises are exempt, but only for services, and the exemption is narrower than most people think.

On fines, honestly: no published presidential decree with amounts can be found, so if anyone quotes you a figure, ask them for the Government Gazette reference. The risk is real, though, and became more concrete with law 5218/2025, which provides for collective action. The good news is that six simple mistakes account for about 96% of the problems, such as light grey text on a white background and images without a description.

Who is covered, which standard applies, and five tests you can run yourself (starting with unplugging the mouse) are in web accessibility: what a Greek website has been required to do since 2025.

The assistant that has to say it is not a person

If you have a chat window on your page that answers automatically, there is an obligation that fits in one sentence: the visitor must know they are not talking to a person. It is set out in article 50 of Regulation (EU) 2024/1689 on artificial intelligence, the AI Act, and it has applied since 2 August 2026. It was not postponed. The date of 2 December 2026 you may have heard concerns something else, the technical marking of generated content, not informing the visitor.

By the letter of the text, the design obligation falls on whoever builds or supplies the system. Except that the notice, if it is missing, is missing from your page. So open your site as a stranger would and see whether the first thing you read in the chat tells you who you are talking to. If not, ask your supplier. The same article also covers text generated by a program and published to inform the public on matters of public interest, with an exception when a person has edited it and takes editorial responsibility.

What each paragraph says, and what I changed in our own assistant when I looked at it with this eye, is in the assistant on your page has to say it is not a person.

When you are the customer: everything in writing

The responsibility is not only towards your visitors. It is also towards the people who sell you services: the hosting provider, whoever registered your domain, the developer, the telecoms provider. And there the rule is a single one. What was said on the phone does not exist.

We lived it up close, at home. A package that was never activated left behind a debt of about 300 euros, on a tax number under the wrong name, and the answer on the phone was «six months have passed». Five habits that cost nothing came out of that story. The most useful: every cancellation in writing, a request number before you say anything else, an email summarising the call straight afterwards, and a monthly look at what is registered in your name. And a tool few people know: with an access request under article 15 of the GDPR you ask a company for everything it holds about you, and the answer is due within one month.

The whole story, with the provisions alongside, is in the debt for nothing.

What to ask your provider, on one page

If you do not want to deal with any of the above, you do not have to. You do need to know what to ask whoever does it for you. The questions are few and none of them is technical:

When was restoring from a backup last tested? How often are plugins updated, and who checks the site afterwards? What grade does the encryption get, and do certificates renew automatically? Does the domain have SPF, DKIM and DMARC? What does the page load before the visitor clicks «accept», and where is the proof of consent kept? Does the chat assistant say it is a program? And if you sell online, has an accessibility check ever been done?

If the answer to any of these is «I do not know», that is not a disaster. It is where you start. And ask for the answers in writing, for the reasons in the previous section.

And the part this page does not cover

Here we talked about responsibility. The site itself, meaning what to watch before you commission it, what has to be yours, where it is hosted, how fast it is and when it is time to replace it, has its own page: the guide to your website. And how customers find you today, now that many of them ask an engine instead of searching, is in the guide to answer engines (AI).

And something that needs saying: nothing on this page is legal advice. I show you where each thing is written, so you know what to ask. For your own case, the right person is your lawyer.