Is My Website Secure? What to Check

Most small business owners find out their website wasn't secure enough after something's already gone wrong: a defaced homepage, a stream of spam suddenly going out under their domain, or a "your site has been suspended" email from the host. None of that needs a clever hacker. So is my website secure right now, before any of that happens? The National Cyber Security Centre, the UK's own authority on this, points at somewhere far more ordinary: the password and the account behind the site, and whether anything's actually backed up.

Is my website secure enough?

Probably not, if the honest answer to "when did I last check" is never. Most small sites aren't broken into through some flaw in the code, they're broken into through the login that manages them, the email account tied to that login, or a backup that turns out not to exist when it's needed. Those three things are worth checking on their own, separately from however good or expensive the build itself is.

Where does a small site actually get broken into?

Almost never through the site's own code. Almost always through the account guarding it. A reused password picked up in an unrelated data breach, a phishing email that collects a login, a support inbox nobody checks, any of those hand a criminal the same access an owner has. The site itself never has to be attacked directly at all.

What does the NCSC recommend for passwords?

Length over cleverness, and something to remember it by rather than guess at. The NCSC's own guidance recommends combining three random, unrelated words to make a password that's long enough to be strong and plain enough to remember, rather than the old advice of a short password stuffed with symbols, which people tend to solve with predictable substitutions attackers already expect. Where remembering several of those is the problem, the same guidance points at a password manager to generate and store them instead.

Whichever password you land on, the NCSC names email as one of the most important accounts to add 2-step verification to, because a password can be stolen in a breach or a phishing email however strong it is, and 2SV means a criminal holding that password still can't get in without your phone or second device as well. Most site logins run on password-reset emails, so protecting the inbox protects the site behind it too.

What happens if you lose everything overnight?

Whatever you didn't back up is gone, whether that's from a hack, a hosting fault, or someone simply deleting the wrong thing. NCSC guidance for small organisations lists a website itself, alongside emails, invoicing, documents and customer information, as the kind of thing worth backing up regularly, kept in more than one place, online storage and a separate device, in case one copy is lost or stolen. It also makes a point that's easy to skip: a backup nobody has tried to restore isn't proven to work, so the guidance is to actually test that a copy really opens and holds everything it should.

Who is actually responsible for this once your site is live?

Whoever you agreed it with, which is worth pinning down rather than assuming. A hosting company usually secures its own servers, not your personal password habits or whether your own backup has ever been tested. A cheap DIY build often leaves every one of the checks above entirely to you, which is fine as long as you actually do them rather than assume they're covered. What a monthly website fee should include is worth reading with this in mind, because "security" printed on a quote means nothing until you know whether it covers this or just the server underneath.

Every site we build runs with hosting, security, backups and edits included in the same £69 a month care plan. No extra line item to spot was missing. Setup itself is from £495, seen as a private preview before anything is owed. Start a preview here if you'd rather hand this list to someone else than work through it yourself.

Frequently asked questions

Do I need antivirus software to run a website?

That protects the device you use to log in, not the site itself, so it's worth having but it's a different job from what this guide covers. A clean laptop with a weak, reused password on the account behind your site is still an open door.

Does an SSL certificate cover all of this?

No. The padlock in a browser address bar means the connection between a visitor and your site is encrypted in transit, nothing more. It says nothing about whether your own password is strong, whether 2SV is on, or whether a backup exists if the account is ever taken.

My website was built years ago and I've never touched the settings. Does any of this still apply?

Yes, and the age of the build has nothing to do with it. The account and password questions above sit on top of the site, not inside its code, so a criminal doesn't need an old or badly built site to get in if the login guarding it is weak. Worth checking now rather than waiting for a sign something is wrong.