The security basics of a business website are seven things: HTTPS that browsers are told to insist on, email authentication for your domain, updated software and plugins, strong unique logins with a second factor, backups you have tested, limited admin access, and someone who gets the alert. A free outside scan can check the first two. The rest it cannot see, which is why they are where small-business sites are most often caught out. Here is each one, why it matters, who can check it, and a thirty-minute audit you can run this week.
1. Is the site served over HTTPS, and do browsers insist on it?
HTTPS encrypts the connection between your visitor and your site. A header called Strict-Transport-Security, or HSTS, goes one step further. MDN describes it as informing “browsers that the host should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be upgraded to HTTPS.” It also means that if a certificate error occurs, the browser does not offer the visitor a way to click through it. MDN adds that the header must be sent over HTTPS, and is ignored if sent over plain HTTP.
Who can check it: an outside scan, because both the certificate and the header are public. It is one of the checks in our free website scan. Also note the certificate's expiry date and who renews it.
2. Can anyone send email pretending to be your domain?
Your domain's DNS records tell mail servers who may send as you. They are called SPF, DKIM and DMARC. This is no longer only good practice: Google's sender guidelines say that starting 1 February 2024 all senders to Gmail accounts must “set up SPF or DKIM email authentication”, and senders of more than 5,000 messages a day to Gmail must set up SPF, DKIM and DMARC, with one-click unsubscribe on marketing mail. Without them, your quotes and invoices can land in spam, and anyone can more easily send a convincing fake in your name.
Who can check it: an outside scan, since the records are public. One caveat: a DKIM record sits under a name chosen by your mail provider, so a scan that cannot find it should say “could not check”, not “missing”. If you changed mail suites recently, see the Microsoft 365 or Google Workspace comparison and re-check the records, since entries for the old provider may still be there.
3. Is the software behind the site up to date?
Out-of-date software and vulnerable plugins are a common way for a site to be broken into, and an outside check cannot see them. MDN's Observatory FAQ (as captured in June 2026) says its tests do not cover “outdated software versions, SQL injection vulnerabilities, vulnerable content management system plugins, improper creation or storage of passwords”, and that these “are just as important as the issues Observatory does test for”. A clean header grade is not the same as a secure site.
If the site runs on WordPress, the WordPress handbook on hardening (last updated 7 January 2026) says to keep up to date with the latest version, because “older versions of WordPress are not maintained with security updates”. It also says to get plugins and themes only from the WordPress.org repository or well-known companies. The WordPress, Shopify or custom site guide covers what each platform leaves for you to maintain.
Who can check it: whoever runs the site. Ask for the date of the last update of the CMS, the theme and every plugin, and delete the plugins you do not use.
4. Are logins strong, unique and protected by a second factor?
NIST's small business cybersecurity basics (page updated 22 May 2026) say to require strong passwords and consider a password manager, and to require employees to enable multifactor authentication, particularly phishing-resistant MFA, on all accounts that offer it. Turn it on for the website admin, the hosting account, the domain registrar and your email, in that order of risk. The registrar matters more than most owners think: whoever controls the domain controls your website address and your email.
Who can check it: you, in each account's security settings. A scanner cannot.
5. Do you have a backup you have tested?
If the site is damaged or locked, a backup is how you get it back. The WordPress handbook lists backups among its basics and says that having a plan to back up and recover “can help you get back online faster”. It has to be separate from the site, current, and restored at least once as a test. We cover how in backups that actually restore.
6. Who has admin access, and should they?
Count the accounts that can change the site: the agency that built it, a freelancer from three years ago, an employee who left. Remove every account that has no current reason to exist. Give each person their own login, not a shared one, so you can see who did what.
7. Who gets the alert when something breaks?
A site that is down, a certificate that is about to expire or a form that stopped sending leads should reach a named person. Set up monitoring and an alert address, and write down who responds. Test the contact form once a month by sending yourself a message, because a form that fails silently costs leads for weeks.
What does a scan not tell you?
Everything under “who runs the site” above. A free scan reads what the site shows to the outside. It does not log in, test your plugins or look inside your server. For that you need a person who sets up and looks after the system. Our security setup covers accounts with multi-factor sign-in, backups, email authentication and site headers, priced per scope. It is set-up work, not a certified assessment.
What is the thirty-minute audit?
- Run the free scan on your domain and write down what it flags and what it says it could not check.
- Log in to the domain registrar and check the contact email, the expiry date and that a second factor is on.
- List every admin account on the site and remove the ones nobody can explain.
- Open the update screen and write down how many updates are waiting and how old the oldest is.
- Find the last backup, and ask who has ever restored one.
- Send a test message through the contact form and see who receives it.
Book a free intro call if you want a person to go through the list with you.
Sources
- Strict-Transport-Security, MDN, page last modified 23 April 2026, as captured by Common Crawl on 9 June 2026.
- Observatory FAQ, MDN, as captured by Common Crawl on 12 June 2026.
- Email sender guidelines, Google, as captured by Common Crawl on 16 May 2026.
- Hardening WordPress, WordPress Advanced Administration Handbook, last updated 7 January 2026, as captured by Common Crawl on 12 June 2026.
- Cybersecurity Basics, NIST Small Business Cybersecurity Corner, page updated 22 May 2026, as captured by Common Crawl on 7 June 2026.