← All articles · ScanMend · Lietuviškai

How to check your website's security: 10 things you can check yourself

23 October 2026

Small business websites are rarely broken into with sophisticated attacks. Far more often the cause is something simple and well known: an outdated plugin, a forgotten backup file or a domain without email protection. Some of these you can check in your browser; for others you will need access to your hosting panel or DNS settings.

1. Does the site always open over HTTPS?

Type your address with http:// (no "s"). If the browser does not switch to https:// on its own, visitors can end up on an unencrypted connection. Most hosts turn this on with one setting: Hostinger hPanel – Security → SSL → Force HTTPS, cPanel – Domains → Force HTTPS Redirect, Cloudflare – SSL/TLS → Edge Certificates → Always Use HTTPS.

2. Does the SSL certificate renew automatically?

Click the padlock next to the address and check the expiry date. Free Let's Encrypt certificates last 90 days or less, so they have to renew automatically. If the date is close and nothing has renewed, contact your host.

3. Are the CMS, plugins and theme up to date?

On WordPress, open Dashboard → Updates. Every outdated plugin is a possible way in. Delete plugins you no longer use instead of just deactivating them.

4. Which PHP version does the site run?

An old PHP version is easy to overlook, even for developers. You will find it in your hosting panel or in WordPress under Tools → Site Health. According to php.net, security support for PHP 8.2 ends on 31 December 2026, for 8.3 on 31 December 2027 and for 8.4 on 31 December 2028. Older versions no longer receive security fixes at all.

5. Are there public files that should not be there?

Backups (backup.zip, .sql), configuration files (.env, wp-config.php.bak) or phpinfo.php are sometimes left in the web root after a migration or debugging session. Look through the public_html folder in your host's File Manager and delete anything that does not belong. Keep backups outside the website folder.

6. Security headers

These are a few lines in the server's response that tell the browser, for example, to always use HTTPS (Strict-Transport-Security) or not to let other sites embed your pages (X-Frame-Options). You can add them in .htaccess, in Cloudflare or with the WordPress plugin "Headers Security Advanced & HSTS WP".

7. Can someone send email in your name?

Three DNS records handle this: SPF, DKIM and DMARC. Without them, scammers can send messages that look like they come from your company. More in SPF, DKIM and DMARC: how to stop people sending email as your company.

8. Does the cookie banner actually block tracking?

Open the site in a private window and, without clicking anything in the cookie banner, check Developer tools → Application → Cookies. If Google Analytics (_ga) or Meta (_fbp) cookies are already there, tracking starts before consent.

9. Are admin accounts protected?

Use strong, unique passwords and two-factor authentication. Remove accounts of former employees and contractors. Do not use "admin" as a username.

10. Do you have a backup you can actually restore?

A backup only helps if you can restore the site from it. At least once a year, try restoring it, for example to a test subdomain.