Most small business websites that get hacked weren't targeted. Attackers run automated tools across millions of sites looking for the same handful of weaknesses: outdated software, old logins, and no backups. The good news is that you can check for most of them yourself in about ten minutes, without touching any code.
Grab a notepad, open your website in another tab, and work through these eight checks. Mark each one pass or fail.
1. Is the padlock there, everywhere?
Visit your site and look at the address bar. The address should start with https:// and show a padlock or similar icon. If your browser says "Not secure," anything visitors type into your site, such as contact form messages, travels unencrypted.
Then try typing your address with http:// (no "s") at the start. A secure site sends you straight to the https:// version. If it doesn't, that's a fail.
Go a step further: enter your domain at SSL Labs. After a minute or two you'll get a letter grade for your encryption setup. A or A+ is a pass; anything B or below should be fixed by your host or developer.
2. Does Google think your site is safe?
If your site has been hacked to spread malware or scam pages, Google may already be warning visitors away, and you might not know. Enter your address at Google's Safe Browsing site status tool.
Pass: "No unsafe content found." Anything else needs attention today.
3. Is the software up to date?
If your site runs on WordPress, Wix, Squarespace, or a similar platform, how this works depends on the platform:
- Hosted builders (Wix, Squarespace, Shopify): the company handles updates for you. Pass.
- WordPress and similar: log in and look for update notices for WordPress itself, your theme, and every plugin. Any pending update is a fail. Outdated plugins are the most common way small sites get broken into.
While you're there, delete plugins and themes you don't use. Deactivated isn't enough; unused code can still be attacked.
4. Who can log in?
Look at the list of users with access to your website, and do the same for your hosting account and domain registrar (the company you pay for your domain name, such as GoDaddy, Namecheap, or Cloudflare).
- Remove anyone who no longer works with you: former employees, old web designers, contractors.
- Make sure no account is shared by several people.
- Give each person the lowest level of access they need.
Pass: every account belongs to a current, named person who needs it.
5. Is two-factor authentication on?
A stolen password is the easiest way into a website. Two-factor authentication (a code from your phone in addition to your password) stops most of those attempts.
Check that it's turned on for:
- Your website login
- Your hosting account
- Your domain registrar
- The email account those accounts send password resets to
While you're at it, enter your business email at Have I Been Pwned. If it shows up in a breach, change that password and any others that match it.
Pass: two-factor is on for all four.
6. Do you have backups, and do they work?
Ask your host or developer three questions:
- How often is the site backed up? Weekly at minimum; daily if it changes often.
- Where are the backups stored? At least one copy should be somewhere other than the same server.
- When was a backup last restored to test it? A backup nobody has ever restored is a hope, not a plan.
Pass: clear answers to all three. "I think the host does that" is a fail.
7. Is your domain safe?
Losing your domain name means losing your website and your email. Log in to your domain registrar and check:
- Auto-renew is on, with a payment method that won't expire soon.
- The renewal date is more than a few months away, or auto-renew will cover it.
- Registrar lock (sometimes called transfer lock) is enabled.
- The contact email is one you still check.
Pass: all four.
8. Are your forms protected?
Contact and quote forms are a favorite target for spammers, and a hijacked form can be used to send spam in your name.
- Submit your own form and make sure the message arrives.
- Check that the form has some spam protection, such as a hidden check or a CAPTCHA.
- Make sure no form asks for anything sensitive, like card numbers or Social Security numbers, unless it's a proper payment page.
Pass: the form works, has spam protection, and collects only what it needs.
How did you do?
- 8 out of 8: you're ahead of most small business sites. Run this check again every few months.
- 6–7: fix the failures this week, starting with any in checks 2, 4, or 5.
- 5 or fewer: your site is an easy target. Talk to whoever looks after it, or get help.
What to fix first
If you failed several checks, this order closes the biggest risks fastest:
- Safe Browsing warnings (check 2): your site may already be compromised.
- Old accounts and missing two-factor (checks 4 and 5): the easiest way in for an attacker.
- Software updates (check 3).
- Backups (check 6): so you can recover if something goes wrong.
- Everything else.
Want someone to check it for you? My security checkup covers your website, accounts, devices, and backups, with written findings ranked by priority. And every site on one of my website care plans gets its updates, backups, and security fixes handled for you. Get in touch.