Is your website secure? Check the basics.

Most small business websites are not hacked by someone targeting them personally. They are found by automated scanners that look for known weaknesses across millions of sites: an expired certificate, an old plugin, a server that announces its version. The basics below close most of those doors.

What we check

• HTTPS. Without it, browsers label the site "Not secure" and anything typed into a form travels unencrypted. Google also ranks it lower.
• The redirect from http to https. If the old http address still works on its own, you effectively have two websites, one of them insecure.
• The SSL certificate. Who issued it and when it expires. An expired certificate shows visitors a full-page warning and most of them leave.
• Mixed content. Images or scripts loaded over http on an https page. Browsers may block them and show a warning.
• Security headers. Small server settings such as HSTS, X-Frame-Options and X-Content-Type-Options that stop common tricks. They take minutes to add.
• Version leaks and old software. A server that announces "PHP 7.4" or an old jQuery tells scanners exactly where to look.

What an automated check cannot see

We only look at what is public. We cannot see weak admin passwords, outdated plugins that do not show in the page, missing backups or who has access to your hosting. Those matter just as much. A good rule: automatic updates where possible, two-factor login for the admin, and a daily backup stored somewhere other than the server.

What to do next

Most issues in this report are fixed in an afternoon: turn on automatic certificate renewal, add the redirect, add the headers, update what is out of date. If you would rather not deal with it, our maintenance plans include updates, backups and monitoring, so someone notices problems before your visitors do.