Is my website secure? A 10-minute check

You don’t need to be technical to spot the most common website security problems. These ten checks take about ten minutes. If any fail, fix them first. If your site handles logins, payments or personal data, follow up with a proper security test.

1. Is it HTTPS everywhere?

Visit http://yourwebsite.com (without the “s”). It should jump straight to https://. Check a few inner pages too. Every page should show the padlock, with no “not secure” warning.

2. Is the certificate valid?

Click the padlock and look at the certificate. It should be issued to your domain and not expire soon. Set a reminder, or better, use automatic renewal.

3. Does it send security headers?

Security headers tell browsers to protect your visitors. Look for these in your site’s response headers (any free “security headers” checker will show them):

• Strict-Transport-Security: always use HTTPS
• Content-Security-Policy: limits what can run on your pages
• X-Frame-Options or a frame-ancestors policy: stops your site being framed by others
• X-Content-Type-Options: nosniff
• Referrer-Policy

Missing headers are a quick win for your developer.

4. Are admin logins protected?

• Does your admin page use two-factor login?
• Are there accounts for people who have left?
• Is the admin address something obvious, with no protection against repeated guessing?

5. Is everything up to date?

Outdated website software, plugins and themes are the most common way in, especially on WordPress. Check for updates and remove plugins you don’t use.

6. Are your forms safe?

Contact, sign-up and payment forms should:

• use HTTPS,
• have spam protection (such as a hidden trap field, rate limits or a CAPTCHA),
• not show detailed error messages that reveal how your system works.

7. Do you have backups, and have you tested them?

Backups should be automatic, stored away from your main server, and tested. A backup you have never restored is only a hope.

8. Is your email domain protected?

Check that your domain has SPF, DKIM and DMARC records. Without them, criminals can send emails that look like they come from you, which is a common start to invoice fraud.

9. What does Google think?

Search for site:yourwebsite.com and look for pages you don’t recognise, often in other languages or selling things you don’t sell. That can be a sign of a hacked site. Google Search Console will also warn you about security issues.

10. Who has access?

List everyone with access to your hosting, domain, website admin and DNS. Remove people who no longer need it, and make sure the domain is registered in the company’s name, not a former employee’s.

When a checklist isn’t enough

These checks catch the basics. They won’t find flaws in how your app works, such as a checkout that accepts a changed price, or an account page that shows another customer’s data. Finding those takes a penetration test, where people try to break in the way a real attacker would.