Is my website secure? A plain-English check for non-developers

You can check the basics yourself in about 15 minutes, with no technical skills: look for the padlock, make sure no browser or Google warning appears, and see what your site shows to a stranger. That won't prove the site is safe, but it catches the visible problems. For the parts a browser can't show you, send your developer or AI tool the ready-made message below.

What "secure" means for a small website

"Is my site secure?" sounds like one question, but it is really five smaller ones. A small business site or a simple app is in good shape when:

• The connection is private. That's what HTTPS means: the padlock in the address bar. Anything a visitor types, like an email address or a card number, travels encrypted.
• Nobody has broken in. No strange pages, no hidden links, no warning from Google that the site is dangerous.
• Nothing secret is on display. Your site talks to other services: payments, email, AI, a database. It uses keys for that, which are like passwords. Some of them must never end up in the code that every visitor's browser downloads.
• People only see their own data. If customers log in, one customer must not be able to open another's orders or messages.
• The accounts behind the site are locked. Your hosting, your domain, your website builder and your email. Whoever gets into one of them owns the site.

You can check the first two and the last one yourself. The middle two need someone with access to the code, and you'll find a message to send them further down.

Check it yourself in 15 minutes

Use a computer and your phone. Do it on the real address of your site, not on a preview link from your website builder.

1. Look at the padlock. Open your site in Chrome, Safari or Edge. Then type the address again with http:// at the start instead of https://. It should switch to https:// on its own. Click the icon to the left of the address: it should say the connection is secure. If you see "Not secure" or a full-page warning, fix this first. Visitors leave at that point.
2. Open the site in a private window. In Chrome that's "New Incognito window", in Safari "New Private Window". A private window doesn't use your saved logins, so you see what a stranger sees. Now type in the addresses that only you or your customers should see, such as your dashboard or an account page. You should land on a login page, not on the content.
3. Try it on your phone, on mobile data. Turn off Wi-Fi and open the site. Your own computer may have quietly accepted an old warning; a phone that has never visited the site hasn't. If a phone shows "Your connection is not private", the certificate (the file that makes the padlock work) has expired or doesn't match your address.
4. Ask Google whether it flags your site. Paste your address into Google's Safe Browsing site status. It tells you whether Google currently considers the site unsafe. Then search Google for site:yourdomain.com and scroll through the results. Pages you never made, especially about pills, casinos or in a language you don't use, are a classic sign of a hacked site.
5. Look at the cookie banner. Still in the private window, reload your home page. If your site uses analytics or advertising, many privacy laws expect you to ask visitors before those tools start. Does a banner appear, and does saying no actually work? This is a quick look, not legal advice; if you sell to Europe, check the rules for your country.
6. Run a free header test. Headers are short instructions your server sends with every page, telling the browser what to block, for example other sites showing your pages inside theirs. Paste your address into Mozilla's HTTP Observatory. You get a grade from A+ to F. A low grade is no reason to panic: it's usually a small fix for whoever runs your hosting. Mozilla itself points out that even an A+ doesn't mean a site is secure, so treat the grade as one signal.
7. Lock the accounts behind the site. List every account the site depends on: domain registrar, hosting, website builder, database, the email you use for all of them. Turn on two-step login (a code from your phone on top of the password) for each one. While you're there, check that the domain renews automatically and that the card on file hasn't expired.

If all seven look fine, you've ruled out the most visible problems. That is a good start, not the end.

What you can't see from a browser

Three things need someone who can open the code or the database:

• Secret keys in the public code. You can hunt for them yourself if you're curious: how to find API keys in your JavaScript bundle walks through it step by step. It is fiddly, though, and easy to miss one.
• Whether customers can see each other's data. This depends on rules inside the database that you can't see from the outside.
• Backups and updates. Whether a copy of the site and its data exists, and whether plugins and libraries are kept up to date.

If someone built the site for you, or you built it with an AI tool such as Lovable, Bolt, Cursor or Replit, paste this message to them. It asks for yes or no answers, so you can understand the reply.

I own [your site address]. I'm not technical. Please check the points
below and answer each one in plain language: yes or no, plus one
sentence. Don't change anything yet; tell me what you found first.

- Does every page load over https, and does http:// redirect to https://?
- Is any secret key (payments, AI, email, database admin) in code that
  runs in the visitor's browser? If yes, which one and where?
- Can a logged-out visitor, or one customer, read data that belongs to
  someone else? How did you test it?
- Which security headers does the server send, and which are missing?
- Is two-step login on for the hosting, domain, database and code accounts?
- Is there a backup of the site and the data, and has anyone tried
  restoring it?
- Do the domain and the SSL certificate renew automatically?

What to fix first

If you found several problems, this is a sensible order, from "costs you customers or money today" to "worth doing this month":

• A warning page or "Not secure". Visitors see it before they see you.
• A secret key in the public code. Anyone can copy it and run up bills on your account, or read data with it. The key has to be replaced, not just hidden.
• Customer data visible to the wrong people. This can turn into a data breach you have to report.
• Accounts without two-step login. One leaked password is enough to lose the site.
• Missing headers and cookie settings. Usually a short configuration change, and it closes off whole kinds of attacks.

When you ask for a fix, ask also how to check that it worked. A fix is done when the check passes, not when someone says it's done.

Keep checking without doing it by hand

A check like this is a snapshot. The next update, a new plugin or one more prompt to your AI builder can undo a fix without anyone noticing.

ScanYourSite runs the outside part of this list for you. The free check needs no sign-up and takes about a minute: you enter your address, or open https://scanyoursite.app/?check=yourdomain.com with your own domain in it. It looks at your live site the way a browser does, and it never logs in, fills in forms or guesses passwords. It checks:

• whether the site redirects to https and when the certificate expires;
• which security headers are missing;
• whether any secret key shows up in the code your site sends to visitors;
• whether your domain is protected against fake emails sent in its name;
• when the domain itself expires, if its registry publishes the date (.com does; some country domains, such as .de or .ru, don't, so check those at your registrar as in step 7);
• whether analytics or ad trackers run with no recognised consent tool on the page, and whether there's a link to a privacy policy;
• search basics, such as the page title and the preview people see when they share your link.

It doesn't click your cookie banner, so whether saying no really stops the trackers is still the private-window test from step 5.

The report lists every finding with how serious it is. In the free version, the three most important come with a plain explanation, the fix and a message you can paste into your AI tool; Pro explains all of them.

A free account watches one site: a check every week, a weekly email summary, a warning before your certificate expires, and three findings explained with fixes. Pro ($19 a month, three sites) checks the whole site daily, checks within minutes of every update that the site still loads and no secret key leaked, checks that the site is up every five minutes, and tells you as soon as something new goes wrong. On Pro, once you've confirmed the domain is yours, it also checks for files that should never be public, like .env, the file where secret settings are kept, and counts how many rows of your database tables a stranger could read, without ever reading what's in them.

None of this replaces a professional security review if you handle payments directly or store sensitive data like health records. For everyone else, it means you hear about a problem from a check, not from a customer.