How to check website security: the 10-minute DIY checklist

July 28, 2026

You've put your site online, maybe with the help of AI or a ready-made theme, and now you're left with a nagging doubt: is it actually safe? The good news is that checking website security doesn't require you to be a hacker. You can run most of the important checks yourself, from your browser, in about ten minutes. All you need is attention and a clear checklist.

That's exactly what this guide gives you: a list of practical checks anyone can run on their own. For each one I explain what to look at and what it means if the result is "red". At the end I'll also tell you what you can't verify by hand, so you know where automated tools are needed.

If you'd rather understand the general principles of what makes a project solid first, you'll find them in what makes a website secure. Here we stay hands-on.

Why check your site's security (even if it's small)

There's a myth worth killing right away: "my site is too small, nobody cares about it". False. Most attacks are automated: bots scanning the internet for sites with known flaws, neither knowing nor caring what you sell. A site with a weak password or a key left in plain sight is a target, full stop.

For a maker or a small business owner, checking your site's security means protecting three things: your users' data, your reputation and your money (a GDPR breach can get expensive). And the best part is that the first checks cost nothing.

A practical checklist to check website security

Here are the checks in order, from the simplest to the most technical. You can run them all in sequence.

1. HTTPS and SSL certificate

What to look at: open the site and look at the address bar. The URL must start with https://. Click the padlock (or the icon to the left of the address) and open the certificate details: check that it's valid and not expired.
If it's red: if you see "http://" without the "s", or a warning like "Not secure" or "Certificate expired", data travels in the clear. Anyone on the same network can read it, including passwords typed into forms. Fix it immediately: almost every host offers a free SSL certificate (Let's Encrypt).

HTTPS and the SSL certificate are the first brick: without them, everything else loses value.

2. Keys and secrets visible in the page source

This check surprises a lot of people, especially anyone who built their site with AI or no-code tools.

What to look at: open your site, right-click and choose "View page source" (or press Ctrl+U / Cmd+Option+U). With Ctrl+F search for words like api_key, apikey, secret, token, password, sk_. Take a look at the JavaScript files the page loads, too.
If it's red: if you find a full API key, a password or a token, it's publicly exposed to anyone who opens the page. With that key someone can use your paid services, read your database or send email in your name. Revoke and regenerate it immediately, moving secrets server-side.

3. Security headers

Headers are invisible instructions your site sends to the browser. Some of them exist to protect users.

What to look at: you don't need to read code. There are free online site checkers where you paste your address and they tell you which security headers are present. Look for entries like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options.
If it's red: if they're missing, the site is more exposed to attacks such as clickjacking or script injection. It isn't an immediate red alert like an exposed key, but it's a sign the configuration should be hardened.

4. Cookies and consent (GDPR)

What to look at: open the site in an incognito window. Does a cookie banner appear before tracking cookies are installed? Does the banner genuinely let you refuse, or is there only "Accept"? Is there a reachable privacy policy page?
If it's red: if the site installs profiling cookies without asking, or if you can only accept and not refuse, you're out of compliance. Beyond the risk of fines, it signals carelessness towards your users.

5. Software and plugins up to date

What to look at: if you use WordPress, Shopify or any CMS, go into the admin panel and check the updates section. Themes, plugins and core should all be on the latest version.
If it's red: an out-of-date plugin is the number one way in for compromised sites. Known vulnerabilities are fixed by updates: if you don't update, you leave the door open. Turn on automatic updates where you can.

6. Passwords and access

What to look at: is the admin password long, unique and randomly generated? Is two-factor authentication (2FA) enabled? Are there still old admin accounts you no longer use?
If it's red: a password like admin123 is guessed by a bot in seconds. Use a password manager, turn on 2FA and delete unused accounts.

7. Working backups

What to look at: do you have a recent, automated backup of the site and the database? Do you know how to restore it?
If it's red: without backups, if something goes wrong (attack, mistake, failed update) you risk losing everything. Backups don't prevent problems, but they're your safety net. If you've never tested one, try a restore: a backup you don't know how to restore is as good as none.

If you want to dig into the various types of test and the tools dedicated to each, they're covered in detail in website security testing.

What you can't check on your own (and why)

The checklist above uncovers a lot, but it has a limit: it only looks at the surface. Some problems hide where the human eye can't reach.

Endpoints with no authentication: APIs or "hidden" URLs that return sensitive data to anyone who knows them. You won't see them by browsing normally.
No rate limiting: nothing stopping a bot from trying thousands of passwords or overloading your service.
Secrets buried in JavaScript files: keys that aren't in the main source but inside minified bundles that are hard to read by hand.
Inconsistent GDPR setups between the cookies you declare and the cookies actually installed.

Checking all of this by hand would take developer skills and hours of work. And it's exactly the kind of check an automated scanner does systematically. Tools like Appurai analyse your site (including ones built with AI or vibe coding) and show you, for free, exposed keys, open endpoints, missing headers and cookie problems, without you writing a line of code. Useful precisely for covering what the manual checklist can't reach.

How often to repeat the checks

Security isn't a box you tick once. Here's a simple, sustainable rhythm:

On every significant change: after adding a feature, a form or a key, redo checks 2 and 5.
Once a month: updates, passwords, backups.
Every quarter: a full scan to see whether anything new has appeared.

A few minutes at a time is enough to avoid big trouble.

Frequently asked questions

Can I really check a website's security with no technical skills?

Yes, for most of the basic checks. HTTPS, cookies, passwords, backups and the page source are all things you can inspect from your browser. Deeper analysis (endpoints, rate limiting) does require an automated tool.

How do I know whether my site is genuinely secure?

No site is "100% secure", but if you pass every point on the checklist you're already well above average. The next step is an automated scan that also checks what you can't see by eye.

Does the padlock mean the site is secure?

No, it only means the connection is encrypted (HTTPS). That's necessary but not sufficient: a site with a padlock can still have exposed keys or weak passwords. Don't stop at the padlock.

I found an API key in the page source, what do I do?

Revoke it straight away from the service that issued it and create a new one, keeping it server-side and never in public code. If the key has been exposed for a while, check your logs for suspicious activity too.

What if I discover the site has already been compromised?

Don't panic and work methodically: isolate the site, change passwords and restore a clean backup. You'll find the step-by-step procedure in hacked website: what to do.

In summary

Checking website security isn't just for experts. With the checklist in this guide you can inspect the points that matter most on your own: HTTPS, exposed keys, headers, cookies, updates, passwords and backups. Do it regularly and you'll have already eliminated most common risks.

For what the human eye can't see, a free automated scan gives you a complete picture of what to fix in a few minutes. It's the quickest way to move from "I hope it's fine" to "I know it's fine".