How to Check Whether Your Website Is Protecting Your Business

Updated November 2026.

A business website can load normally while an attacker adds spam pages, steals administrator access, or changes a payment destination. Checking only the home page misses those failures. Google advises site owners to watch for unexpected indexed pages, unusual search queries, and server-log activity as possible signs of abuse. Read Google’s prevention guidance.

Start with access and software

List everyone who can log in to the website, hosting account, domain registrar, and email system. Remove accounts that are no longer needed. Give each person only the permissions required for their job and enable multifactor authentication wherever available. Apply supported updates to the content management system, themes, plugins, and server software; a secure connection does not patch vulnerable code. Australia’s Cyber Security Centre website guide covers these controls for business site owners.

Check HTTPS, but understand its limit

HTTPS encrypts traffic between the browser and the website and helps users connect to the intended domain. Check that the certificate is valid and that sensitive pages do not load mixed HTTP resources. MDN explains transport security. The padlock does not tell you whether an administrator account is compromised or whether a plugin is vulnerable.

External header scans have a similar limit. MDN says a strong Observatory grade is not a declaration that a site is secure; its checks cover selected preventive measures, not every application flaw. See the Observatory FAQ.

Prove that recovery is possible

Confirm that backups include the files and database needed to restore the site. Record where they are stored, who can access them, and when the last successful restore test occurred. NIST recommends protecting and testing backups. A backup that has never been restored is an assumption. Keep a simple response plan: who can take the site offline, rotate credentials, contact the host, and notify affected customers if necessary.

Monitor what visitors and search engines see

Check Google Search Console for security alerts and unexpected indexed URLs. Review new administrator accounts, file changes, outgoing mail, redirects, and server logs when available. Set a cadence that matches the site’s risk; a checkout or lead form deserves closer attention than a static brochure. Search Console can warn about some harmful content, but absence of an alert is not a clean bill of health.

The useful test is operational: can the business detect a suspicious change, identify who has access, and restore a known good site quickly? If the answer is uncertain, prioritize those gaps before buying another badge or scan.