Is My Website Secure? A 15-Point Website Security Checklist for Small Businesses

“Is my website secure?” is a reasonable question with no single yes-or-no answer. What you can do is check the handful of things attackers look at first. Most successful attacks on small business websites exploit the same predictable gaps: outdated software, weak logins, missing HTTPS settings, forgotten files and unprotected email domains.

This 15-point checklist is written for owners and managers, not security engineers. Each item explains why it matters and how to check it, usually in a few minutes. Work through it with your web developer or hosting provider.

The checklist at a glance

The sections below explain each item and how to check it.

HTTPS and encryption

1. Every page loads over HTTPS

Type http://yourdomain.com and http://www.yourdomain.com into your browser. Both should redirect to the https:// version automatically. Mixed or missing HTTPS lets traffic be read or altered on public Wi-Fi, and browsers label such sites “Not secure”.

2. The TLS certificate and configuration are healthy

Click the padlock and check the certificate is valid and not close to expiry. A free online SSL test will also tell you whether old protocols such as TLS 1.0 and 1.1 are still enabled; they should not be. Our guide to TLS misconfigurations explains what to look for.

3. Security headers are set

Headers such as Strict-Transport-Security, Content-Security-Policy and X-Frame-Options tell browsers to block whole classes of attack. Check them in your browser’s developer tools or with an online header scanner. See how to check and add security headers.

Software and updates

4. Your CMS, theme and plugins are up to date

Outdated WordPress plugins and themes are one of the most common ways small sites get compromised. Log into your admin panel and check for pending updates. Turn on automatic minor updates where your platform supports it.

5. Unused plugins, themes and accounts are removed

Every installed component is code an attacker can target, even if it is deactivated. Delete what you do not use. The same goes for old user accounts belonging to former staff or agencies.

6. Your site does not advertise its software versions

View the page source and response headers. Lines like Server: Apache/2.4.29, X-Powered-By: PHP/7.4 or a CMS version in a meta tag tell attackers exactly which known vulnerabilities to try. Ask your host to hide version numbers.

Logins and access (website authentication)

Website authentication covers every way someone proves who they are to your site: the admin login, customer or member accounts, password reset links and the hosting and domain dashboards behind it all. Attackers rarely break encryption; they log in with stolen or guessed credentials. Checks 7 to 9 close the gaps they use most.

7. Admin logins use strong, unique passwords and two-factor authentication

Every account that can change your website, hosting, domain or DNS should have a unique password from a password manager and two-factor authentication. This single step defeats most credential-stuffing attacks.

8. Login pages are protected against brute force

Try entering a wrong password several times: the site should slow you down, lock the account temporarily or show a challenge. If it lets you guess endlessly, attackers can too. Many hosts and security plugins offer rate limiting.

While you are there, check two related details. Error messages should not reveal whether a username exists (“wrong username or password” rather than “this user does not exist”), and password reset links should expire quickly and work only once. If customers log in to your site, offer them two-factor authentication as well.

9. Admin areas are not exposed unnecessarily

Panels such as /admin, /wp-admin, database tools like phpMyAdmin, or staging copies of your site should not be openly reachable by anyone on the internet. Restrict them by IP address, VPN or extra authentication where possible.

Exposed files and data

10. No backups, logs or configuration files are publicly downloadable

Files like backup.zip, database.sql, .env or wp-config.php.bak left in the web folder can hand over your whole database or passwords. Ask your developer to check, and make sure backups are stored outside the public web root.

11. Directory listing is disabled

Visit a folder such as yourdomain.com/wp-content/uploads/ or /images/. If you see a list of files instead of a page or an error, directory listing is on and anyone can browse your files. It is a one-line server setting to turn off.

12. Forms validate input and are protected from spam abuse

Contact and quote forms should reject unexpected input, limit file upload types and sizes, and use spam protection. Unprotected forms are abused to send spam from your domain, which damages your email reputation.

Domain and email

13. SPF, DKIM and DMARC are configured

Without them anyone can send email that appears to come from your domain — the basis of fake-invoice fraud. Check that all three records exist and that DMARC eventually reaches p=reject. Follow our step-by-step SPF, DKIM and DMARC guide, or check your domain instantly with our free security check, which also covers checks 1 and 3.

14. Your domain and DNS accounts are locked down

Whoever controls your domain registrar account controls your website and email. Use two-factor authentication, keep contact details current, enable the registrar lock, and make sure the domain auto-renews.

Backups and recovery

15. You have recent, tested backups stored separately

Ask your host or developer three questions: How often are backups taken? Where are they stored? When did we last restore one successfully? A backup you have never restored is a hope, not a plan.

Five extra checks if you handle payments or sensitive data

If your site takes payments, collects documents or stores customer accounts, add these to your routine.

16. You know every third-party script your site loads

Chat widgets, analytics, ad pixels, booking tools and fonts all run code from other companies inside your pages. Open your browser’s developer tools, go to the Network tab and reload the page to see which outside domains it contacts. Remove what you no longer use. Each remaining script is a dependency you trust with your visitors’ data.

17. Card details are entered on your payment provider’s page, not yours

Hosted checkout pages and payment links keep card numbers off your own server, which shrinks both your risk and your compliance work. If your developer built a custom card form, ask how card data is handled and which payment security requirements apply to you.

18. Your privacy and cookie notices match what the site actually does

Compare the scripts you found in check 16 with what your privacy and cookie policies say. A cookie banner that claims nothing is tracked while analytics loads anyway, or a policy listing tools you removed long ago, undermines trust and can create legal exposure.

19. Someone is alerted if Google flags your site

Add your site to Google Search Console. Its Security issues report shows whether Google has detected hacked content, malware or other security problems on your site, so make a habit of checking it. You can also look up any site in Google’s Safe Browsing site status tool.

20. Staff email addresses are checked against known breaches

Passwords leaked in other companies’ breaches are reused against your logins. Check your team’s work addresses on Have I Been Pwned, change any exposed passwords, and make two-factor authentication mandatory.

“Most small business breaches are not sophisticated. They walk through a door that was left open — and checklists are how you find the open doors.”

NyorsoftExternal Security Review

How did your website score?

• 13–15 checks passed: a solid baseline. Keep it up with regular updates and an annual review.
• 9–12: typical for small business sites. Fix the gaps in order: logins, updates, exposed files, email.
• 8 or fewer: your site is an easy target. Prioritise two-factor authentication, updates and HTTPS this week.

What this checklist cannot tell you

A self-check covers the visible basics. It will not reveal subtle issues such as weaknesses in custom code, forgotten subdomains, leaked credentials, or how several small problems combine into a serious one. That is where an independent review helps. Our Public Website Security Check covers this checklist and more from an attacker’s point of view and gives you a ranked, plain-English report for a fixed $790. You can download a sample report to see exactly what you would receive. See all options on our pricing page or read what a website security audit costs.

Frequently asked questions

How can I tell if my website is secure?

Start with the basics: HTTPS on every page, a valid TLS certificate, up-to-date software, strong admin logins with two-factor authentication, no exposed backups or admin panels, and SPF, DKIM and DMARC for your email domain. For certainty, have an independent external security review done.

Is the padlock in the browser enough to show a site is secure?

No. The padlock only means the connection is encrypted with a valid certificate. The site behind it can still run outdated software, leak files or have weak logins.

How often should I check my website’s security?

Check updates monthly, run through a checklist like this one every quarter, and have an independent review at least once a year or after major changes to your site or hosting.

Can a small business website really be hacked?

Yes. Most attacks are automated and indiscriminate: bots scan the internet for known weaknesses regardless of company size. Small sites are often targeted precisely because they are less likely to be protected.

How do I secure website authentication?

Use unique passwords from a password manager and two-factor authentication on every admin, hosting and domain account, limit failed login attempts, keep error messages generic, make password reset links expire after one use and restrict admin panels to known IP addresses where possible.

What should I fix first?

Enable two-factor authentication on admin, hosting and domain accounts, apply pending software updates, and remove anything publicly exposed that should not be. Those three steps close the most common entry points.