Most attacks on small business websites are not targeted. They are automated scans looking for the same handful of mistakes. You can check for most of them yourself in about fifteen minutes.
1. Who can log in? (3 minutes)
Open the admin area of your website, hosting account, domain registrar, and DNS provider. For each one:
- Remove accounts for people who no longer work with you.
- Turn on two-factor authentication for every account that is left.
- Make sure at least two trusted people can get in, so you are never locked out.
2. Is everything up to date? (3 minutes)
If your site runs on a CMS such as WordPress, check for pending updates to the core software, the theme, and every plugin. Delete plugins you do not use. Unused plugins can still be exploited.
3. Is HTTPS enforced? (2 minutes)
Visit your site with http:// instead of https://. You should be redirected to the secure version automatically. Your browser should show no certificate warnings.
4. Check your security headers (2 minutes)
Paste your domain into securityheaders.com. A low grade does not mean you have been hacked, but it does mean easy protections are missing. Ask your developer about Strict-Transport-Security and Content-Security-Policy first.
5. Can someone send email as you? (3 minutes)
Look up your domain’s DNS records (your registrar or DNS provider shows them). You want:
- An SPF record (
v=spf1 ...) listing the services allowed to send your email. - DKIM enabled with your email provider.
- A DMARC record (
v=DMARC1; ...), ideally withp=quarantineorp=rejectonce you have confirmed legitimate mail passes.
Without these, anyone can send convincing email that appears to come from your domain.
6. Do backups exist, and do they work? (2 minutes)
Find out where your website backups are stored, how often they run, and when someone last restored one. A backup you have never restored is a guess, not a backup.
What next
If any of these turned up surprises, fix the access and update items first, since they are the most common way in. If you want a second pair of eyes, our web security service starts with exactly this kind of review, written up in plain language.