Articles ·
We checked 215 London dental practice websites: 9 in 10 cannot stop fake emails sent in their name
Patients trust emails from their dentist: appointment reminders, treatment plans, invoices. We checked whether that trust is protected at 215 independent dental practices across all 33 London boroughs. No jargon: every technical term is explained in one line.
The short version
- Only 1 practice in 10 has told Gmail and Outlook to block fake emails sent in its name.
- More than half of the websites are missing all four basic safety settings that a developer can switch on in an hour.
- Nine websites run on software that stopped receiving security fixes years ago.
- The good news: every website uses a secure connection (the padlock in the browser).
How we checked
We collected the websites of 215 independent dental practices in Greater London from public listings, one website per practice, without the big national chains. A program then looked at each home page the way any visitor or Google does. We did not try to break in, log in or open hidden pages. We publish only totals, never practice names.
1. Can a scammer send email in your name?
196 of the 215 practices use email on their own website address. This is what we found for them:
- Fake emails are blocked or sent to spam10 %
- Fakes are only watched, nothing is blocked42 %
- No protection set up at all47 %
Totals may not add up to 100 % because of rounding.
Some email services catch obvious fakes on their own, so this does not mean patients are being tricked every day. It means that 9 practices out of 10 leave it to luck. Fixing it usually takes your IT person or email provider an hour or two, and the website keeps working.
- Lviv: fake emails blocked0 %
- London: fake emails blocked10 %
- Lviv: no protection at all79 %
- London: no protection at all51 %
Lviv: our earlier study of 71 private clinic websites. Here both cities are counted across all websites checked.
2. Basic safety settings on the website
- No “always use the padlock” (HSTS)70 %
- No script rules (CSP)82 %
- No anti-framing protection82 %
- No file-type setting74 %
- Missing all four53 %
None of these is visible to patients, and a missing setting does not mean a site has been hacked. But each is a few lines in the server settings, and together they close the most common tricks.
3. Is the website kept up to date?
Websites are built from ready-made parts, and those parts get security fixes. When a site stops being updated, known holes stay open.
- More than half of the sites (56 %) are built on WordPress, a popular website builder. That is fine when it is updated, but six sites run WordPress versions that are years old.
- Nine sites run on a version of PHP, the engine behind the website, that no longer gets security fixes. Two still use a version abandoned in 2018.
- 14 sites (7 %) use an old version of jQuery, a common piece of website code, with publicly known weaknesses.
- Old jQuery with known weaknesses7 %
- PHP without security fixes5 %
- WordPress several versions behind3 %
4. Speed and patients with poor eyesight
A typical website started answering in 1.2 seconds, which is good, but 22 sites took more than 3 seconds, long enough for a patient on a phone to give up. On 29 % of sites at least one photo has no text description. Blind and partially sighted patients use apps that read the page aloud; without a description, the app just says “image”. The missing ones are often the important photos: the entrance, the team, the price list.
Five steps for a practice owner or manager
1. Send this question to whoever manages your email: “Do we have SPF, DKIM and DMARC set up, and is DMARC set to block fakes (quarantine or reject), not only to watch them?”
2. Ask your web developer: “When were WordPress, the plugins and PHP last updated, and do we have a recent backup?”
3. Ask them to switch on the four basic safety settings from section 2. It is usually under an hour.
4. Ask them to hide the version numbers of WordPress and PHP in the page code. It fixes nothing by itself, but it stops telling attackers which known holes to try.
5. Add a short description to important photos: “Practice entrance on the High Street, step-free access on the left”, not “IMG_2041”.
Want to see where your own practice stands? Our free Website Checker runs these checks in about a minute and explains the result in plain English. To check only the email protection, use the email spoofing checker.
Limitations
This is an automatic check of public information, not a security audit of any practice, and individual figures may vary. Seven sites showed only a holding page or a bot check, so they were left out of the website checks. Data as of 15 October 2026.
Study by OLBO, a small web studio in Lviv, Ukraine. Journalists and dental associations are welcome to use the figures with a link to olbo.com.ua.