Articles ·
How to check website security yourself: six checks in 10 minutes
Most small-business sites are not hacked by someone targeting them. They are hacked by bots scanning the internet for old WordPress versions, old plugins and forgotten settings. Much of that is visible from the outside in minutes. Here is what to check.
The Website Checker runs all six checks below automatically in about a minute and shows a free score for each.
1. HTTPS and the certificate
The address should start with https:// and the browser should not say “Not secure”. The certificate must be valid and renew automatically. A free Let’s Encrypt certificate is available in most hosting panels.
2. Security headers
These are short instructions the site gives the visitor’s browser: always open the site securely, do not let other sites embed it, do not run foreign code. They cost nothing, yet most sites lack them.
3. Outdated components
An old version of WordPress, PHP or jQuery is the most common way in. If nobody has updated the site for years, start here — and test updates on a copy of the site first.
4. Known vulnerabilities
Many platform and plugin versions have publicly listed security holes. A known vulnerability does not mean the site is already hacked, but closing it now costs far less than cleaning up later.
5. Blacklists
Check whether Google has flagged the site as dangerous in the Google Safe Browsing report. Another sign of a hack is hidden links to casino or betting sites in the page code.
6. Email protection
SPF, DKIM and DMARC records stop fraudsters from sending email in your company’s name. Check your domain with our free DMARC checker.
What an online check cannot see
An outside check sees only what the site shows publicly. Weak passwords, unused admin accounts, missing backups or holes in custom code show up only in a manual audit. An online check is a fast first step, not a guarantee.
If you need help after the check, OLBO offers technical audits.