Skip to main content
Back to dashboard

Help Centre

Guides for every part of Cyber Essential Check. Open the ones you need - each explains what the section does and how to work through it.

Security alert: update PHP now (October 2026)

Two critical PHP flaws, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), let attackers take over websites without logging in. They are already being used in real attacks.

  • Check whether your website or online systems use PHP (most WordPress, Joomla and Drupal sites do).
  • Ask your web host or IT provider to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 straight away.
  • PHP 8.1 or older no longer gets fixes. Upgrade, or take the site offline until it is updated.
  • Record the PHP version in your Asset inventory.

Cyber Essential Check itself does not use PHP and is not affected.

This short wizard asks a few questions about your business so we know what to check for you.

  1. Tell us how big your business is
    Enter how many people work with you and roughly how many laptops, phones or tablets they use for work.
  2. Your website addresses
    List each website address you own, one per line - e.g. yourbusiness.co.uk. We'll test email and web settings on each.
  3. Where you keep your files & email
    Tick the services you use - Microsoft 365, Google Workspace, Xero, etc. This tells us where connectors can help.
  4. Check and save
    Look over what you've entered, then save. You can come back and change it any time.
Use the Plain English toggle in the header to switch wording.

Answer a few yes/no/not-sure questions about how your business runs. We'll turn them into a readiness score.

  1. Say it how it really is
    Only tick 'Yes' if it's genuinely true today. If you're not sure, pick 'Not sure' - we'd rather flag it than miss it.
  2. Your answers save automatically
    You don't need to finish in one go. Answers save as soon as you pick them.
  3. Get your score
    When you finish, we create a report showing what's fine, what to fix, and any 'auto-fails' to sort first.
Use the Plain English toggle in the header to switch wording.

We check the outside of your website and email settings - no login needed. Everything we test is already public.

  1. Type your web address
    Enter your website address (e.g. yourbusiness.co.uk) and press Start. It usually takes under a minute.
  2. What we're checking
    We check whether your email is protected from spoofing, whether your website uses secure connections, and whether anything private is accidentally exposed.
  3. Read your report
    Green means good. Amber means improve. Red means fix urgently - those are 'auto-fails' for Cyber Essentials.
  4. Fix things and check again
    After you make changes, hit 'Rescan' to see your score improve. We show a before/after diff.
Use the Plain English toggle in the header to switch wording.

Your firewall (or router) is your front door to the internet. We check it's up to date, locked down and safe.

  1. Add each box you have
    Add every router or firewall your business uses. Give each a nickname like 'Head office' or 'Warehouse'.
  2. Choose how we check
    Pick 'Test from the internet' if you know your office's public address. Otherwise pick 'Ask me questions only'.
  3. Which model and software version
    Pick your make and model, then enter the software version (sometimes called firmware). It's usually on a Status or About page in the admin screen.
  4. Answer the plain-English questions
    A short list of yes/no questions - default passwords changed, admin only on the office network, and so on.
  5. Run the check
    Press 'Run checks'. You'll get a readiness score, a list of auto-fails, and simple guides on how to fix each.
Use the Plain English toggle in the header to switch wording.

Your firewall runs software called firmware. Here's how to find its version number and release date so we can check it's still supported.

  1. Open your firewall's settings page
    Open a web browser on your office network and go to your firewall's admin address - usually something like 192.168.1.1 or 10.0.0.1. Sign in with the admin username and password.
  2. Look for the version number
    Look for a Status, Dashboard, About, System Information or Firmware page. The version is often shown near the top - for example '7.2.8' or 'v24.03'.
  3. Find when it came out
    Some firewalls show the release date next to the version. If not, write down the exact version and search the vendor's support site for that version's release notes.
  4. Type them into the form
    Type the version into 'Software version' and pick the release date from the calendar. If you're not sure of the exact date, use your best guess or leave it blank.
Use the Plain English toggle in the header to switch wording.

Connectors let us peek inside your Microsoft 365 or Google account - safely, read-only - to check things like MFA is on.

  1. Choose Microsoft or Google
    Pick the service you use for email and files. We only ask for permission to look - we can't change anything.
  2. Sign in as an admin
    You'll be redirected to Microsoft or Google. Sign in with your admin account and press 'Allow'.
  3. Your login is kept safe
    We store the connection encrypted. You can disconnect any time and we'll delete it.
  4. What we look at
    Things like: is MFA turned on for everyone, are old accounts removed, are shared drives locked down.
Use the Plain English toggle in the header to switch wording.

Staff phishing scorecard

On the Phishing page, each person gets a score out of 100 based on the last 12 months.

  • Everyone starts at 100. Each click on a practice email takes off 25 (12.5 if it was over 6 months ago).
  • Reporting a practice email as suspicious adds 10.
  • Training in the last 6 months adds 10, plus 5 more for a quiz score of 80% or higher.
  • 80 or more is low risk, 50 to 79 is medium risk, under 50 is high risk.
  • Anyone who clicked since their last training, or hasn't trained for 12 months, is marked "Needs training".

The scorecard is also included in your evidence pack.

Linking your antivirus

Antivirus is software that catches harmful programs. Cyber Essentials needs it switched on and up to date on every computer. If you use Microsoft Defender, Sophos or SentinelOne, you can link it so we see every computer's status automatically. Access is read-only - we never change any settings - and you can disconnect at any time, which deletes the stored key straight away.

Microsoft Defender

  1. On the Cloud connectors page, connect Microsoft 365 with an administrator account.
  2. In the Antivirus section, press Connect Microsoft Defender. That's it.
  3. Only Windows computers managed by Microsoft Intune appear. Other computers can use the Device checks script.

Sophos Central

  1. Sign in to Sophos Central as an administrator.
  2. Go to Global Settings, then API Credentials Management.
  3. Press Add Credential, give it a name like "Cyber Essential Check" and choose the role Service Principal Read-Only.
  4. Copy the Client ID and Client Secret shown and paste them below. The secret is only shown once.
  5. On the Cloud connectors page, press Connect Sophos Central and paste them in.

SentinelOne

  1. Sign in to your SentinelOne console. Copy the address from your browser bar (it ends in .sentinelone.net).
  2. Go to Settings, then Users, then Service Users, and press Create New Service User.
  3. Give it the Viewer role (read-only) and an expiry date, then copy the API token shown.
  4. Paste the console address and token below.
  5. On the Cloud connectors page, press Connect SentinelOne and paste them in.

Results appear on the Device checks page under "From your antivirus" and update every day. Green means protected, amber means out of date, red means protection is off or a threat was found.

Still stuck?

Ask whoever manages your IT, or contact us and we'll walk you through it.