Is Your Website Secure? A Security Check for Small Businesses
Most small business websites are not attacked by someone who picked them out. They are caught by automated tools that look for sites with old software or weak logins. A few basic checks close most of those doors.
This list is what we would check first. It is not a full audit, and we say below what a full audit adds.
Our main page for this service: Web Application Testing.
Ten quick checks you can do yourself
Go down the list and note what you are unsure about:
- The whole site loads over HTTPS, with no warnings
- Your site software, themes and plugins are up to date, and unused ones are removed
- The admin login is not at the default address, and uses a strong, unique password
- Two-step verification is on for admin and hosting accounts
- Backups exist, and someone has tried restoring one
- Former staff and agencies no longer have access
- Forms have spam protection and do not email passwords or card details
- Your hosting panel and domain account are protected with their own strong passwords
- Your email domain has SPF, DKIM and DMARC records
- Someone is named as responsible for all of this
Signs a site may already be compromised
Visitors sent to other sites, strange pages appearing in Google results, new admin users you did not create, or a warning from your hosting provider. If you see any of these, change passwords, take a backup and ask for help early.
What a proper audit adds
A checklist looks at settings. An audit tests the site from an attacker's side, including the logins, forms and any custom code, and tells you what is actually exploitable. It is worth it for shops, portals and anything that holds customer data.
Frequently asked questions
Can you check my site for me?
Yes. Send us the address and tell us what the site holds, and we suggest a sensible scope.
Will it cost a lot?
It depends on the size of the site and the depth of the check. We quote in writing after a short call.
My site is on a platform like Shopify. Do I still need this?
The platform secures its own systems. You are still responsible for your passwords, the apps you add and who has access.
What should I do first?
Turn on two-step verification, update your software and check your backups. Those three remove the most common problems.
Want us to look at your site?
Send us the address and what the site is used for. Call +91-86194 70448 or email contact@gtsltd.in. We work remotely, in English, with businesses in India and abroad.