When legal cannabis access first gained momentum in the UK, the focus was completely on helping people. Clinics, patient groups, and community collectives needed websites set up quickly to share information, book appointments, and answer urgent questions. Turning to familiar, user friendly platforms like WordPress was the natural choice. That early effort made legal access possible, but it also meant that routine website maintenance and security updates often took a back seat.
How Early Websites Became Vulnerable Over Time
As the years went by, many of these websites grew complex, adding custom booking forms, patient consultation pages, and third party plugins. Yet the underlying web servers often remained untouched. Web agencies and business owners frequently avoided major software updates out of worry that an update might break an existing booking calendar or payment form.
Over several years without routine updates, those servers quietly fell behind. What was once modern software slowly became outdated, leaving digital doors open to automated attacks.
What Stood Out While We Were Updating Our Own Sites
While updating the websites we host, and following published security advisories, several consistent issues stood out:
First, many web servers run older programming versions, such as PHP 7.4 or 8.0, that no longer receive official security patches from the global developer community. You can verify this directly on the official PHP Supported Versions Schedule. When vulnerabilities are discovered in older code, security advisories are published publicly. Automated scanning programs constantly crawl the web looking for servers running those older versions, creating an easy target if systems are not updated.
Second, a large number of websites lack basic browser security rules, known as defensive headers. These simple lines of configuration instruct web browsers to block hidden framing and protect form submissions from being tampered with. You can test your own website headers for free anytime using SecurityHeaders.com, an independent tool created by cybersecurity researcher Scott Helme.
Third, domain email protections are frequently missing or left on inactive settings, leaving clinics and community businesses open to email impersonation.
“In 2018, launching on WordPress was how our community scaled rapidly. Today, patient consultation records, clinic bookings and medical histories demand disciplined, modern infrastructure. Organisations must ensure their underlying software receives verified security patches.”UKCSL Team, UK Cannabis Support Line
Why Protecting Your Email Address Matters
One of the most critical vulnerabilities we identified was the absence of domain email protection, known as DMARC.
When a clinic or business communicates with patients, messages often contain sensitive topics: appointment verifications, doctor approvals, and prescription fee requests. Without an enforced DMARC policy (set to quarantine or reject), bad actors can send emails that appear to come directly from your exact domain name. A scammer could impersonate your clinic to send a patient fake banking details for a prescription payment, causing financial loss and destroying hard earned trust.
You can check whether your domain email is protected right now by using MXToolbox, a widely respected free utility that tests your public DNS records. Setting up DMARC instructs major mail providers like Gmail and Microsoft Outlook to reject or quarantine fake emails before they ever reach an inbox.
Simple Steps to Protect Your Community and Website
Fixing these issues does not require massive budgets or ripping out your current website. In most cases, it comes down to asking your hosting company or web developer four practical questions:
- Is our server operating system and software actively supported with current security updates?
- Do we have an enforced DMARC policy in place to stop scammers forging emails from our domain?
- Are our website connection settings enforcing modern encryption (HTTPS)?
- Have we added standard browser security headers to protect our forms?
You can test each of these individually using free public tools like Qualys SSL Labs for encryption, MXToolbox for email, and SecurityHeaders for browser defenses.
We built our free check at the top of this page to bring all these public tests together in one straightforward report, giving you the exact questions to hand to your web team. If your developer needs guidance, or if you want an experienced second pair of eyes on your setup, the UKCSL technical casework desk is always here to support you at 0161 524 1567 or support@ukcsl.co.uk.
Hosted on Google Firebase & Built with AIDOIDO
UKCSL’s digital services run on Google Firebase hosting and cloud datastores, engineered in partnership with AIDOIDO.
Modernising Your Website: Clean Cloud Architecture
To resolve older website vulnerabilities permanently, many organisations are moving towards modern cloud architectures. Rather than keeping all website files, plugins, and patient booking records on a single shared server, modern setups separate the public website from private data systems.
By deploying prerendered static web pages or modern frameworks connected to secure cloud databases with granular server enforced security rules, common server vulnerabilities like file tampering and code execution are greatly reduced.
Even with modern web setups, good habits remain essential. Full security requires active website encryption, verified email authentication to stop domain spoofing, and regular routine maintenance.
Notice: The security check tool, diagnostic reports, and technical guidance provided by the UK Cannabis Support Line (UKCSL) are strictly for general informational, educational, and community support purposes. They do not constitute formal legal advice, statutory certifications, or official regulatory determinations. UKCSL provides independent community guidance to assist organisations in identifying technical areas for review with their developers and web hosts.
Renowned Authorities and Technical Sources Cited
- W3Techs: Usage Statistics and Market Share of PHP and WordPress for Websites
- The PHP Development Group: Official Supported Versions Schedule and Release Timelines
- National Cyber Security Centre (NCSC UK): Guidance on Mitigating Malware and Ransomware Attacks
- CISA (US Cybersecurity Agency): Known Exploited Vulnerabilities (KEV) Catalog (Web Application & CGI Exploits)
- Information Commissioner's Office (ICO): Guidance on General Data Security Principles and Encryption
Taking Proactive Steps: NCSC Resources
We believe in helping, not hindering. A key part of digital resilience is ongoing verification. For organisations aiming to strengthen their defences, the National Cyber Security Centre (NCSC) offers invaluable, free resources. Their advice and guidance is straightforward and practical.
You can further verify your security posture using services like their DNS Check and Early Warning tools. These are excellent, reliable ways to proactively check the health of your systems, ensuring you remain as secure as possible. Integrating these practices into your routine shows you take both patient trust and technical responsibility seriously.
