Is my website secure? A 15-minute check
You cannot tell by looking. A site can look perfect and still have an open back door. Most small business sites run into the same six everyday problems, and you can check all of them in about 15 minutes. Nobody can promise a site is 100% secure.
The 15-minute check
1. Is the padlock there? (2 minutes) Open your site on your phone and computer. You want a padlock or "https" and no "Not secure" warning. If it is missing, your host or site builder can usually turn it on for free. See Why does my website say "Not secure"?
2. Who has the keys? (3 minutes) Write down three logins: your domain (where you bought the name), your hosting or site builder, and your website admin. If the person who built your site years ago is the only one with them, fix that first.
3. Is two-step login on? (3 minutes) Turn on two-step login (a code on your phone) for those three logins and for the email address they send to. Stolen passwords are one of the most common ways in.
4. Is anything out of date? (3 minutes)
- Wix, Squarespace and Shopify update the server for you. Skip to step 5.
- WordPress: log in. If you see "updates available", run them, and delete plugins you do not use.
- WordPress on a hosting plan: also ask your host whether your site runs a current, supported PHP version. Only they can confirm it.
5. Are private files public? (2 minutes) Old backups, test pages and settings files sometimes get left where anyone can open them. This is hard to see yourself, and it is what an outside check is for.
6. Do you have a backup you have actually used? (2 minutes) Ask your host or builder: "Do you keep backups, how far back, and how do I restore one?" A backup you have never restored is a guess.
Signs your site is not safe right now
- A red "Deceptive site ahead" or "This site may be hacked" warning.
- Google shows pages on your site you never made.
- Phone visitors are sent to a different website.
- Your host emails you about malware or abuse.
If you see any of these, read How do I know if my website was hacked? and contact your host the same day.
What "secure" really means
- The padlock means nobody can listen in between your visitor and your site. It does not mean the site itself is safe.
- Secure in practice means: the right people have the logins, the software is up to date, private files are not public, and you can restore a backup.
- Anyone who promises "100% secure" is selling something.
If you built an app with a tool such as Lovable, Bolt, Replit or Cursor, the checks that matter most are different. Start with Leaked API keys in your frontend and Supabase RLS check for AI-built apps.
How DeployVet fits
A DeployVet check looks at your live site from the outside: HTTPS and the padlock, files that should not be public, exposed keys, security headers, broken pages and basic search-visibility items, with fixes in plain English. It does not look inside your server, find past hacks or hidden malware, or check your PHP version.
FAQ
How can I check if my website is safe for free?
Do the six steps above, then run a free outside check. DeployVet's free check shows the most important problem a stranger can see.
Does the padlock mean my website is secure?
No. It means the connection is private. It says nothing about exposed files, old software or weak logins.
Is a Wix or Squarespace site secure?
The company keeps the server updated, which removes a lot of risk. Your login is still the weak spot, so turn on two-step login.
How often should I check my website?
After any change to the site, and about once a month.
Can a website security check hack my site?
An outside check like DeployVet only requests what any visitor can already reach. It does not log in or change anything.
Check your site for free
DeployVet checks your live site from the outside, like a stranger would. You get a score out of 100 and the most important finding with a fix.
DeployVet has three plans. The Free check is $0. A one-time Scan is $7. The Fix it pack is $10 once and adds 30 days of "Did I fix it?" re-checks and score history. For paid plans you pay first, then the scan runs.
DeployVet is an outside-in check, not an audit, a penetration test or a certification. It sees only what a stranger can reach from the public internet, and a clean result is not a guarantee. Only check sites you own or have permission to check. See the methodology for what is and is not checked.