How do I know if my website is secure?

The basics anyone can check

• HTTPS everywhere. The padlock shows on every page, and http addresses redirect. See whether you need SSL.
• Updates. On WordPress, the dashboard lists pending core, theme and plugin updates. A long list is a risk.
• Logins. Every admin uses their own account, a strong password and two-factor authentication.
• Old accounts. Former staff and past designers have been removed.
• Backups exist somewhere other than the server.

If you can tick all five, you’re ahead of many small business sites. If you can’t answer one of them, that’s the place to start.

Signs something is already wrong

Search site:yourdomain.ca and scan the results. Pages about pharmaceuticals or casinos you never wrote are a classic sign. Other clues: visitors on phones get redirected somewhere strange, your host suspends the account, Google Search Console sends a security warning, or your emails start landing in spam because your domain was used to send junk.

If you see any of these, change passwords, restore a clean backup and update everything, in that order. Then ask Google to review the site in Search Console if it flagged a problem.

Why platform choice changes the risk

Security risk grows with moving parts. A WordPress site with twenty plugins has twenty pieces of third-party code to keep patched. A hosted builder handles security for you, within its limits. A static site has no database or admin panel exposed to the internet, which removes the most common attack routes. None is perfectly safe, but some need far less watching.

Your domain and email accounts matter too. Turn on two-factor authentication at your registrar and email provider. If someone takes over the domain account, they control the website and the inbox, no matter how well the site itself is built.

I build static, prerendered sites partly for this reason. There’s no login page to guess, no plugins to exploit and no database to inject into. What’s left is the domain, the host and the forms, and I keep those locked down under the Pulse Plan. For a WordPress site, I’d start with the update list and the user list. Those two screens tell you more about your real risk than any security scanner. Clear those, then turn on two-factor login for everyone who has access.