1HTTPS everywhere

Open your site typing http:// instead of https://: it must redirect to the secure version on its own. Check that the certificate is valid and who renews it before it expires. A site that also sends the HSTS header tells browsers never to use the insecure version.

2Security headers

A few response headers block whole classes of attacks: Content-Security-Policy, X-Content-Type-Options, protection against framing (frame-ancestors or X-Frame-Options) and Referrer-Policy. Free online scanners show in seconds which ones are missing.

3Software kept up to date

Most attacks on company sites exploit known vulnerabilities in CMSs, plugins and themes that were never updated. Update regularly and remove what you no longer use: an unused plugin is still an open door.

4Administrative access

  • Strong, unique passwords and multi-factor authentication for every administrator.
  • Personal accounts, not shared ones; remove access for people who no longer work with you.
  • Limit login attempts and check who has administrator rights.

5Backups you have actually restored

Automatic backups, stored outside the server, and at least one restore test. A backup that has never been restored is only a hope.

When to ask for help

If the site handles personal data, has forms, reserved areas or e-commerce, these checks are not enough: a structured assessment finds problems that are not visible from the outside.