Comment by crimsoneer

Except you really don't need to do that. Your risk assessment could explain it's read only, you've done some basic searches, and that's proportionate given the content and the fact you're a small website. Job done.