Most website security problems are invisible until something goes wrong. A compromised site does not always look broken. In many cases the owner has no idea until Google flags it, a customer reports something suspicious or the hosting provider sends a warning.
The basics to check
The most common vulnerabilities are also the most preventable. Here is what to check:
- The site uses HTTPS, so the website address in a browser should start with https:// and show a padlock icon. If it shows http:// or “not secure”, the SSL certificate is either missing or expired, which affects both security and Google search ranking.
- The software is up to date, which for a WordPress website means checking the admin panel for pending updates to the core software, plugins or themes. Outdated software is one of the most common entry points for attackers, and How much maintenance does a website need? explains what keeping it current involves.
- Passwords are strong and unique, so a website admin password that is simple or used on other accounts should be changed.
- A recent backup exists, meaning the site could be restored from a backup taken in the last week if it were compromised today. Many organisations assume the hosting provider handles backups, and whether it does depends on the provider and the plan.
- User accounts are current, so a web developer, contractor or staff member who no longer works with the organisation should not still have access. Their account should be removed or the password changed.
Signs something may already be wrong
- The site is loading unusually slowly or behaving strangely.
- Google Search Console is showing warnings. See Google Search Console.
- Customers have reported suspicious redirects or unexpected content.
- The hosting provider has flagged unusual activity.
- There are unexpected admin users or unfamiliar files in the hosting account.
If any of these apply, the site may already be compromised and needs prompt attention.
How we help
If it is unclear where a site stands, a security review covers all of the above and more, including email accounts, cloud tools and user access. It is delivered as part of our Cyber Security & Safety service. For the broader picture of what good security looks like, see What is cyber security?
