Repère Security Guides Checking your own site
What you can check yourself on your website
Nine checks a site owner can run alone, with no special tools and no technical background. Each comes with what it reveals, and above all with what it does not tell you.
Before you start
Everything below is done on your own site, with access you already have. Nothing here needs an analysis tool, and nothing should be tried on someone else's site.
The Canadian Centre for Cyber Security puts four measures at the top of what a small business should do: apply patches, use strong authentication, back up and encrypt data, and have a plan for an incident. The checks below will tell you where you stand on the first three.
What the address bar says
1. Does the site answer over HTTPS?
Open your site. The address should start with https://. Then try the version without the “s”: you should be sent automatically to the secure one.
What it tells you: traffic between your visitors and the site is encrypted.
What it does not tell you: more or less everything else. A perfectly encrypted site can have an administration account open to anyone. The padlock proves the conversation is private, not that the other party is in order.
2. Is the certificate current?
Click the padlock: the browser shows the expiry date. A certificate expiring in a few days with no automatic renewal will turn into a full-page red warning for your visitors.
What it does not tell you: anything about how solid the configuration behind it is.
3. Are all the pages on HTTPS?
Browse three or four pages, including one with a form. If the padlock disappears somewhere, a resource on that page is loading without encryption.
Your accounts
4. Who has administrator access?
Sign in to your management tool and open the user list. Read it line by line and ask one question of each: does this person still work with us?
This is the check that turns something up most often. The agency that rebuilt the site three years ago, last summer's intern, the freelancer from a finished project: their accounts are rarely closed, because nobody is responsible for closing them.
What it does not tell you: whether an account was used recently, or by whom. The list shows who can get in, not who did.
5. Is two-factor authentication on?
Check whether your administration accounts ask for a second factor on top of the password. It is one of the four priority measures named by the Canadian Centre for Cyber Security, and it is usually the best return for the effort involved.
6. How many people hold the highest role?
Most tools have several levels. If everyone is an administrator, nobody really is: someone who publishes articles does not need to be able to install components.
What the site runs
7. What is installed, and what is actually used?
Open the list of plugins or modules. Two columns matter: what is deactivated, and what has not been updated in a long time.
The WordPress documentation is explicit on the first point: a component that is deactivated but still installed should be deleted, not left in place. On the second, a component whose vendor no longer ships anything will never receive a patch, however diligent you are.
What it does not tell you: whether any of them carries a known weakness. Establishing that means cross-referencing every component and every version against published vulnerabilities, and that is audit work.
Your forms
8. Where do the replies go?
Fill in your own contact form and follow what happens. Does the reply arrive? In which mailbox? Is it also recorded somewhere? Who can read that record?
Check what you ask for as well. A callback form does not need a date of birth. What you do not collect cannot leak.
What it does not tell you: what the form does with the input once it has it. A form that passes data somewhere other than to you produces no visible error.
Your backups
9. Do you have any, and do you know how to restore them?
Two questions, not one. Plenty of sites have backups. Far fewer owners have ever watched a restore work. Ask your host or your provider how far back the oldest available backup goes, and how long a rollback would take.
Check too that they are not stored only on the site's own server. A backup that lives in the same place as the thing it protects disappears along with it.
What this list does not replace
Worth remembering
These nine points cover what can be established from the surface, with access you already have. They say nothing about how your site handles what is sent to it, nothing about the access rules between your different areas, and nothing about what your components actually expose.
No reassuring result here means the site is in order. These checks can reveal problems. They can never confirm the absence of one.
If any of these nine points worried you, the next question is which form of examination fits: audit, scan or penetration test, the differences in practice.
If your site runs on WordPress, this guide sets out what an audit examines there.