Website Security Check: A Free 30-Minute Self-Audit

Run a free website security check in 30 minutes: which tools to use, signs your site is hacked, a security checklist and what to do in the first hour of a hack.

Published 18 June 2026 by Web Hippo in Web Dev

A website security check tells you two things: whether your site has already been compromised, and how easy it would be to compromise. Most small business owners only find out about a hack when a customer forwards a screenshot of a betting page, or when Google puts a red warning in front of their homepage. By then leads have been lost for days.

This guide is for owners and marketers checking their own site. You will get a 30-minute self-check using free tools, the signs that a site has been hacked, a practical security checklist, a first-hour plan for when something goes wrong, and what Indian businesses need to know about CERT-In reporting and the DPDP Act.

The 30-Minute Website Security Check

Run these checks in order. The first two tell you whether Google already considers your site dangerous, which matters more than any grade. The rest show how well the site is configured. None of them require installing anything.

What Each Free Tool Actually Checks

Knowing what a tool cannot see matters as much as its score. A green result from one scanner is not a clean bill of health.

Google Search Console: Security issues

The Security issues report lists problems Google has found on your site: hacked content (code, content or URL injection), malware and unwanted software, and social engineering such as phishing or deceptive pages. Affected pages can show a warning label in search results or a full-page browser warning. It only works if your site is verified in Search Console, which is one more reason to set that up on day one. It also doubles as the place you request a review after a clean-up.

Google Safe Browsing site status

The Safe Browsing site status tool shows Google's current verdict on any URL without you having to visit it. This is the list Chrome and other browsers use to show red "dangerous site" warnings, so it is the fastest way to answer "is my site showing a warning to customers?" It is also useful to check your payment gateway, booking widget or any third-party script domain you load.

SSL Labs, securityheaders.com and HTTP Observatory

Qualys SSL Labs Server Test analyses your HTTPS setup: certificate, protocol versions and cipher configuration. Tick "Do not show the results on the boards" if you would rather the result stayed private. securityheaders.com grades the HTTP response headers your server sends, from A+ down to F. Its free web scanner still works, although its API closed in April 2026.

Mozilla's HTTP Observatory now lives on MDN (developer.mozilla.org/en-US/observatory) after the old Mozilla Observatory was retired in 2024. It checks headers and related configuration in more depth and explains each fix. It no longer tests TLS, so use SSL Labs for that.

Sucuri SiteCheck

SiteCheck looks for known malware, malicious redirects and scripts, spam, blocklisting and outdated CMS versions. Sucuri is upfront that it is a remote scanner: it sees what a browser sees and cannot detect backdoors, phishing kits or mailer scripts sitting on the server. Treat a clean SiteCheck result as "nothing obvious on the surface", not "not hacked".

Is My Website Hacked? Warning Signs to Look For

Many hacks are built to stay invisible to the owner. Google's guide for hacked sites notes that hackers often cloak content, showing spam to Google and some visitors while you see a normal page. Look for these signs:

Spam pages in Google. A site: search shows pages you never created, often in Japanese, or about pharma, casinos, loans or replica goods. The "Japanese keyword hack" creates auto-generated Japanese pages in random folders to sell counterfeit goods through your domain.
Redirects only on mobile, or only from Google. The site looks fine when you type the address on your laptop, but visitors who tap your result on a phone land on a betting or scam site. Test on mobile data, from a Google search, in a private window.
New owners in Search Console. An email saying someone you don't know verified your site is a strong sign of a hack. Attackers add themselves so they can submit their own sitemaps.
Unknown admin users in WordPress or your CMS, or familiar users with changed email addresses.
Sudden traffic or indexing spikes in Search Console for queries unrelated to your business.
Host warnings about high CPU, outgoing spam email, or an account suspension.
Changed files you didn't touch: an edited .htaccess file, unfamiliar PHP files in upload folders, or code containing long encoded strings.

In the sites we audit, the mobile-only redirect is the one owners miss most often, because they only ever open their own site on a desktop while logged in. Ask a colleague to search your brand on their phone once a month.

Website Security Checklist for Small Businesses

Most small business sites in India are compromised through the same few gaps: an outdated plugin, a reused password, or an old freelancer account that still has admin access. Closing these gaps does more than any paid scanner.

HSTS and security headers, in plain words

HSTS (HTTP Strict Transport Security) is a header that tells browsers "only ever load this site over HTTPS". It stops someone on public Wi-Fi from quietly downgrading a visitor to an insecure connection. Start with a short duration, confirm every subdomain works on HTTPS, and only then lengthen it, because a mistake is hard to undo.

Other headers limit what a hacked or malicious script can do. A Content-Security-Policy lists which domains may run scripts on your pages, and a framing rule stops other sites loading yours inside a hidden frame. CSP takes the most care, since marketing tags, chat widgets and payment scripts all need allowing, so add it in "report-only" mode first.

Most of this checklist is ongoing work, not a one-time project. Our website maintenance guide covers how to schedule updates, backups and checks so they actually happen.

If Your Site Is Hacked: The First Hour

The first hour decides how much damage a hack does and whether you keep the evidence you need. Resist the urge to start deleting files straight away.

Clean up and request a review from Google

Google's recovery guide walks through the steps: build a support team, quarantine the site, use Search Console, assess the damage, identify the vulnerability, clean the site and then request a review. For CMS sites, the clean-up usually means reinstalling core files, themes and plugins from fresh copies, removing unknown files, and checking the sitemap and .htaccess for injected URLs.

Only then open the Security issues report and click Request Review, explaining what happened and what you fixed. Google says reviews can take several days or weeks and asks you not to resubmit while one is pending. Requesting a review before the site is fully clean just extends the time you are flagged. Afterwards, use URL Inspection to confirm Google sees clean pages, and make sure the hacked URLs now return a 404 or 410 so they drop out of the index.

India: CERT-In Reporting and DPDP Breach Duties

CERT-In's 6-hour reporting rule

Under the CERT-In directions of 28 April 2022, service providers, intermediaries, data centres, body corporates and government organisations must report the incident types listed in its Annexure I within 6 hours of noticing them. The list includes website defacement and intrusion, including unauthorised changes such as inserted malicious code or links. Reports go to incident@cert-in.org.in or the toll-free number 1800-11-4949.

Who counts? CERT-In's FAQ on the directions defines "body corporate" to include a company, firm or sole proprietorship engaged in commercial or professional activity. Individual citizens are not covered. The same FAQ says the 6-hour window applies to listed incidents that meet certain criteria, such as severe incidents, data breaches or leaks, and large-scale or frequent intrusions into websites. You may report with whatever information you have and add details later.

So small businesses can be covered. Whether a spam injection on a five-page brochure site must be reported within 6 hours is a judgement call. Our practical view: if customer data may be involved, or you are unsure, report early with what you know. The downside of a short, early report is small.

DPDP Act: when a hack is a personal data breach

If the attacker could read enquiry form submissions, customer accounts or order details, that is likely a personal data breach under the Digital Personal Data Protection Act, 2023. Under the DPDP Rules, 2025, breach notification duties apply from about 13 May 2027. You will need to tell affected people without delay, in plain language, and notify the Data Protection Board, with a detailed report within 72 hours. Our DPDP compliance checklist for marketers covers the timeline and penalties.

Common Mistakes We See

Trusting one green scan. Remote scanners miss server-side backdoors. Combine them with Search Console and your own checks.
Letting the agency keep admin forever. When a developer or agency relationship ends, their logins should end the same day.
Backups on the same server. If the server is compromised or the hosting account is suspended, the backups go with it.
Chasing an A+ header grade and breaking the site. A strict CSP added in one go can silently kill your analytics, chat widget or payment button. Roll it out gradually.
Ignoring the domain registrar. Whoever controls the domain controls the website and email. Put 2FA and a registrar lock on it.

Getting Help With Website Security

If your 30-minute website security check turned up an A-grade certificate, no Google warnings and a short list of named admins, you are ahead of most small business sites. If it turned up unknown users, an old WordPress version or no recent backup, fix those first. If you are choosing a new host, our guide to hosting a website covers what to look for.

Our web development team builds and maintains business websites with updates, backups, security headers and access reviews built in, and can help clean up and harden a site after a hack.

Frequently Asked Questions

Last checked September 2026. Tool features, Google's review process and Indian reporting rules change; recheck the linked sources before acting. This post is general information, not legal advice.