How do I check if my website is secure?
Start with what's visible from the outside: your SSL certificate, your HTTP security headers, the software versions your site reveals and how your domain's email is protected. These are exactly what automated scanners and attackers check first, and they're all things you can test without logging into your server.
1. A valid SSL certificate and HTTPS everywhere
- Your certificate is valid, issued for the right domain and not close to expiry. Expired certificates trigger full-page browser warnings.
- Every HTTP URL redirects to HTTPS.
- There's no mixed content: no images, scripts or styles loaded over plain HTTP on an HTTPS page.
- The server supports modern TLS (1.2 and 1.3) and has older protocols switched off.
2. HTTP security headers
Security headers are instructions your server sends to the browser about how to handle your site. They're one of the cheapest security wins available:
- Strict-Transport-Security (HSTS) forces browsers to always use HTTPS for your domain.
- Content-Security-Policy (CSP) limits where scripts and other resources can load from, which reduces the impact of cross-site scripting (XSS).
- X-Content-Type-Options: nosniff stops browsers guessing file types.
- X-Frame-Options or CSP frame-ancestors prevents your site being embedded in other pages for clickjacking.
- Referrer-Policy controls how much of your URLs is shared with other sites.
- Permissions-Policy switches off browser features like camera or geolocation that you don't use.
3. Don't advertise your software versions
Headers like Server or X-Powered-By, and generator meta tags, can reveal exact CMS and server versions. That makes it easy for automated attacks to target known vulnerabilities. Hide version numbers and, more importantly, keep the software updated.
4. Protect your email domain with SPF and DMARC
Even if your website is secure, scammers can send email that appears to come from your domain unless you publish email authentication records in DNS.
- SPF lists the servers allowed to send email for your domain. See setting up SPF.
- DKIM adds a cryptographic signature to outgoing mail.
- DMARC tells receiving servers what to do with mail that fails SPF or DKIM, and sends you reports. Start with p=none and move to quarantine or reject. See setting up DMARC.
Gmail and Yahoo now require SPF, DKIM and DMARC for bulk senders, so these records also help your legitimate email reach the inbox.
5. Keep the basics in order
- Update your CMS, themes and plugins promptly, and remove ones you don't use.
- Use strong, unique admin passwords and two-factor authentication.
- Keep regular off-site backups and test that you can restore them.
- Publish a clear privacy policy, and a cookie consent banner where the law requires one. See adding a privacy policy.
Does website security affect SEO?
Yes. HTTPS is a confirmed Google ranking signal, browsers warn visitors away from insecure or expired-certificate sites, and a hacked site can be flagged or removed from search results entirely. Security is also a trust signal for customers and AI search tools alike.
Frequently asked questions
How can I tell if my website is secure?
Check that it has a valid SSL certificate, redirects all HTTP traffic to HTTPS, sends security headers such as HSTS and Content-Security-Policy, keeps software updated, and has SPF and DMARC records for its email domain. A website security scanner checks most of these automatically.
What are security headers?
Security headers are HTTP response headers that tell browsers how to behave when handling your site, for example to always use HTTPS (HSTS), restrict which scripts can run (CSP), or block your pages being framed by other sites (X-Frame-Options).
What happens when an SSL certificate expires?
Browsers show a full-page security warning and most visitors leave. Forms, logins and payments may stop working. Use auto-renewal and monitor the expiry date.
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send email for your domain, DKIM signs messages so they can't be altered, and DMARC tells receiving mail servers what to do when a message fails those checks, and reports back to you.
Is a free SSL certificate good enough?
Yes. Free certificates from providers like Let's Encrypt use the same encryption as paid ones. Paid certificates mainly add warranties or organisation validation.