Is my website secure? Seven checks you can do today

1. Does your address start with https everywhere?

Open your site and look at the address bar: is there https:// and a padlock? Also test the variant without www and a few individual pages. Every page should redirect to https automatically. A site that (partly) works over http leaks everything visitors type in, browsers flag the site as 'not secure' and Google prefers https.

2. When was your CMS last updated?

Does your site run on WordPress or another CMS? Log in and look at the update notifications. Outdated plugins and themes are one of the most common ways small-business sites get hacked, not because someone picks you as a target, but because bots scan the entire internet for known vulnerabilities.

Rule of thumb: updates at least monthly, security updates immediately. Not sure who does this? Then probably nobody does.

3. Test your security headers

Security headers are instructions your site sends to browsers: enforce https, don't allow the site to be loaded inside someone else's frame, restrict which scripts may run. You can test them for free at securityheaders.com, enter your domain and you get a grade.

An F doesn't mean you've been hacked; it does mean basic protection is missing that a developer can add in a few hours.

4. Passwords and two-factor authentication

The admin passwords for your site, hosting and domain registrar: are they unique and long, or are you reusing one that also floats around elsewhere? Turn on two-factor authentication (2FA) wherever possible, especially on your hosting account and domain management, because whoever gets in there has your entire site in their hands.

Also remove old accounts of former employees or previous agencies. Every forgotten account is a door without an alarm.

5. Is there a backup and has it ever been tested?

Ask yourself two things: when was the last backup made, and has anyone ever tried restoring it? A backup that has never been tested is a pile of files you hope is a backup. Good hosting makes automatic daily backups and keeps several generations of them, somewhere other than the site itself.

6. Forms: spam and abuse

If you get a lot of spam through your contact form, that is more than an annoyance: it means the form has no protection against automated abuse. Check whether a spam filter or invisible bot check is in place, and make sure you don't have email addresses sitting on the site as clickable text (they get harvested).

7. The GDPR basics: what do you collect, and does it say so?

Privacy is security too. Check three things: does your privacy statement match what you actually collect, do you ask consent before tracking cookies are set, and do you have data processing agreements with parties that handle customer data for you (email tooling, hosting, accounting integrations)?

This is not paperwork for show: in the event of a data breach, the Dutch privacy regulator looks at exactly these basics.

Several checks failing? This is the order

Start with https and updates (biggest risk, quickest fix), then passwords and backups, then headers and forms. After that, have it reviewed thoroughly once by someone who does this daily: a proper security check also finds what these self-checks can't see, such as flaws in custom code or misconfigured servers.