How to check if your website is secure
Worried your website could be hacked? Here is how to check it is secure, in plain English: HTTPS, exposed files, outdated software and email spoofing, plus a free 60-second check.
Most small-business websites have at least one security gap the owner has no idea about. The good news: you do not need to be technical to find them, and most are quick to fix. Here is what "secure" really means for a normal business website, and how to check yours.
The fastest way: a free automatic check
Before going through anything by hand, run your address through our free website check. In about a minute it tells you, in plain English, whether your site loads securely, whether private files are exposed, whether your software is out of date, and whether scammers can send email using your business name.
1. Does your site load securely (HTTPS)?
If your web address starts with https and shows a padlock, visitors have a secure connection. If it still loads over plain http, browsers show a "Not secure" warning, many visitors leave immediately, and Google ranks you lower. A secure certificate is free and takes minutes to set up.
2. Are private files left out in the open?
Websites often leave behind files that were never meant to be public: configuration files with database passwords, old backups, or copies of the site's source code. Anyone who knows where to look can open them, and they often contain exactly what an attacker needs.
3. Is your software up to date?
If your site runs on WordPress or a similar platform, the core software and every plugin need regular updates. Out-of-date versions are the single most common way small sites get hacked, because attackers scan the internet for known weaknesses and break in automatically.
4. Can someone send email pretending to be you?
Two small settings on your domain, called SPF and DMARC, tell the world's inboxes which servers are allowed to send email as your business. Without them, a scammer can send fake invoices that look like they came from your address, and your genuine emails are more likely to land in spam.
What to do if you find problems
Do not panic. The majority of issues on a small business site are straightforward to fix. If you would rather not touch the technical side, that is exactly the kind of thing we handle on a monthly care plan, so your site stays fast, secure and up to date without you thinking about it.
Common questions
Can a small business website really be hacked?
Yes. Most attacks are not targeted; automated bots scan the whole internet for sites with known weaknesses and break into whatever they find, regardless of how small the business is.
Is WordPress secure?
WordPress itself is secure when kept updated. The risk comes from out-of-date plugins, weak passwords and leaving admin tools exposed.
How often should I check my website's security?
A quick automatic check every month is plenty for most small businesses, plus any time you add a new plugin or make a big change.