Is my websitesecure?
You do not need to be technical to find out whether your website is looked after. Here are five checks you can make yourself, what each one tells you, and the question to send your developer when something is missing.
Why small sites get attacked
In the UK government's 2025 survey, 43% of businesses said they had a cyber security breach or attack in the last twelve months. Most of it is not aimed at anyone in particular. Automated tools try every website they can find, looking for old software with known flaws, weak logins and forgotten pages.
So the question is not whether someone will try your site. It is whether the doors they try are shut. You can find out most of that yourself.
1. The padlock
Visit your site and look for the padlock beside the address. Then type the address with http:// at the start, not https://. You should land on the secure version straight away.
The padlock certificate also runs out, usually every three months, and renews by itself when everything is set up right. When it does not, visitors get a full page warning instead of your site.
Ask your developer“Does every page use https, does the plain http address send people to it, and does the certificate renew by itself?”
2. Software that is up to date
Most break ins on small sites come through software with a known flaw that was never updated: the website system itself, its plugins and theme, or the PHP underneath. Fixes usually come out quickly. The gap is sites that never get them.
If you use WordPress, log in and look at the Updates page. Anything waiting there is worth asking about. Also ask which version of PHP the site runs, because PHP 8.2 stops getting fixes on 31 December.
Ask your developer“Who updates the website, its plugins and PHP, how often, and when were they last updated?”
3. Who can log in
Ask for a list of everyone with an administrator login. Old staff, a previous web designer and test accounts often still have one. Every login nobody uses is a door nobody watches.
Then turn on two step verification wherever you can, so a stolen password is not enough on its own. The National Cyber Security Centre recommends it for every important account, and your website and hosting logins are among the most important you have.
Ask your developer“Can you send me a list of every admin login, remove any we do not need, and turn on two step verification for the rest?”
4. Backups you have tried
A backup you have never restored is a hope, not a backup. Find out where copies of your site are kept, how often they are made, and whether they are stored somewhere separate from the site itself, so one problem cannot take both.
Ask your developer“How often is the site backed up, where are the copies kept, and when did we last check one could be restored?”
5. The settings visitors never see
Every time your site sends a page, it also sends a few lines of instructions to the browser. A handful of them are small security settings: always use the secure address, never show this site inside another one, and only run code from places we trust. They take minutes to add, and plenty of sites have none of them.
Ask your developer“Are the standard security headers set on our site, and if not, can you add them?”
How Mendbird helps
The free check does the first and last of these for you in about ten seconds. It checks the padlock, the secure redirect and when the certificate runs out, reads the security settings your site sends, and matches any software versions your site shows against the public lists of known flaws. Check your site to see where you stand.
It cannot see who has a login or whether your backups work. Those two are worth asking about today.
On a Watch plan the check runs every morning, and you get an email the day a new flaw is found in something your site runs.