Gemini 4 Carbon puts security in the news: check your site's settings

What Google announced

Google has released Gemini 4 Carbon, which it calls its next frontier model. In its announcement, Google describes it as its strongest model, with "state-of-the-art cybersecurity and long horizon capabilities".

The Verge reports that Google claims "significant gains" in coding, agentic tasks and cybersecurity. Google also points to the model's top spot on the Artificial Analysis Intelligence Index (v5.0) benchmark, with Claude Opus 5.5 and GPT-6 Astra behind it. These are Google's own claims about its own model. Independent testing in real business use will take longer.

For a large company with a security team, a model like this could become one more tool on the list. For a small UK business, the first steps in website security are more basic. They are also free.

The free settings your website can already send

Every time someone visits your website, your server sends instructions to their browser along with the page. Some of those instructions are security settings. The browser follows them, so they protect your visitors without anyone installing anything.

Two matter most for ordinary business sites:

• HTTPS enforcement (HSTS). This tells the browser to always use the secure, padlocked version of your site, even if someone types an old link or clicks an out-of-date one. It closes a gap that a simple redirect can leave open.
• A content security policy (CSP). This is a list of the places your pages are allowed to load scripts and other files from. If a bad script is slipped onto a page, the browser can refuse to run it. It helps against a common kind of attack where code is injected into a website.

Neither needs new software or an AI subscription. They are a few lines of configuration, usually set by your web host, developer or platform. A CSP takes a little care, because a strict one can block tools you do rely on, such as analytics or a chat widget. That is why testing it first makes sense.

What this means for UK businesses

AI security tools may become useful over time. For most small firms, though, the quickest win is to make sure the website already sends the standard security settings browsers understand.

• Ask who controls your website settings. That may be your host, your developer or your platform. They can tell you which security settings are switched on today.
• Start with HTTPS enforcement. If your site already works on HTTPS, adding HSTS is usually a small change.
• Test a content security policy before you enforce it. A "report-only" mode lets you see what would be blocked without breaking anything for customers.
• Check again after changes. New plug-ins, widgets and tracking tools can need updates to your policy.

Analysis compiled by Sayu (sayu.co.uk), a UK digital marketing agency.