How can I check if my website is secure?
Short answer
Start with a passive check of HTTPS, security headers, TLS configuration and email DNS records, then keep the CMS, plugins and server software updated, remove unused plugins and admin accounts, and protect admin logins with MFA. For apps that handle sensitive data, commission an authorized penetration test.
The details
Passive checks read only what the site already makes public, so they are safe to run on your own site at any time. Active scanning or testing should only be done with written permission from the site owner.
Useful next reads and tools
- Website Security Check · tool
- Security Header Analyzer · tool
Terms explained
- Penetration testing
- Penetration testing is an authorized, simulated attack on a system to find and demonstrate exploitable weaknesses before real attackers do.
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
Sources
Related questions
- What are SPF, DKIM and DMARC?
- How do I stop someone from spoofing my email domain?
- How do I read email headers to check if a message is fake?
- What are HTTP security headers and which ones should my website have?
- What is a DDoS attack and how do I protect a website from one?
- How do I secure a WordPress website?
Related Guides
GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more GuideSmall Business Security
10 Small Business Cybersecurity Tips to Reduce Risk Fast
Protect your company with ten practical small business cybersecurity tips. Implement MFA, patch software, secure Wi-Fi, and build backups that work.
Read more GuidePersonal Security
How to Secure Accounts: What to Do After a Data Breach
Learn what to do after a data breach exposes your personal information. Follow these practical steps to secure your logins, freeze credit, and stop fraud.
Read more