A website that is out of date or poorly set up can be hacked, and a hacked site can lose you customers and Google trust. These checks take about fifteen minutes and tell you a lot.
1. Look for the padlock
Visit your site and check that the address starts with https:// and the browser shows a padlock or similar icon. If it says “Not secure” there is a problem. See SSL, HTTPS and the padlock.
2. Check that updates are done
WordPress, its theme and its plugins need regular updates, because many hacks use known gaps in old versions. If your site is looked after by someone, ask when the last update was. See website maintenance.
3. Test that backups exist and work
Ask where backups are kept, how often they run and when one was last tested. See backups: how to know yours work.
4. Review who has access
Check that only people who need it have a login, and that anyone who has left no longer does. Old accounts are a common weak spot.
5. Use strong, unique passwords
Every login should have a long, unique password, ideally from a password manager, with two-factor authentication where possible. Never reuse the same password across sites or share it by text.
6. Look at the page in Google
Search for your business name and check that the results and descriptions look right. Odd text, strange pages or spam in the results are warning signs. Google Search Console can alert you to security problems if you set it up.
7. Check your contact form
Send a test enquiry and make sure it arrives. A broken form can mean you lose leads, and spam can flood a poorly protected one.
8. Know who to call
Know who looks after your site and how to reach them in a hurry. See what to do if your website gets hacked.
Security is mostly routine: updates, backups, strong passwords and limited access. If you pay for hosting and care, these are covered.