Your website is often the first thing a customer checks before they call, book, or hand over their card. If a browser flashes a "Not secure" warning — or worse, a red malware screen — most people leave and never come back. The good news: you can check the essentials yourself in about ten minutes, without being technical.
This guide walks through the six things that actually matter, the free tools to check each one, and how to read what they tell you. If you'd rather have it done for you, Trust Shield runs every one of these checks automatically and grades your site — but you can absolutely do this manually first.
Why this matters more than it used to
Two things changed. First, browsers now label any site without a valid certificate as "Not secure" right next to your address — a visible red flag to every visitor. Second, Google quietly de-ranks and sometimes de-indexes sites that are hacked or serving malware, which means a security problem is also a visibility problem. A site nobody trusts and Google won't show is a site that doesn't ring the phone.
Work top to bottom. The first three checks below cover roughly 80% of the real-world risk for a small business site. Start there.
1. Your SSL certificate (the padlock)
The padlock next to your web address means traffic between your visitor and your site is encrypted. Without it, browsers show "Not secure" and forms can be intercepted.
How to check
Open your site and look at the address bar. If you see a padlock, click it — it should say the connection is secure. To go deeper, run your domain through a free SSL checker (search "SSL Labs test"). It grades your certificate from A to F.
How to read it
- A or A+ — you're good. Nothing to do.
- B or C — usually an old protocol or weak cipher. Ask your host to "enable TLS 1.3 and disable TLS 1.0/1.1."
- Expired / no certificate — urgent. Most hosts offer free auto-renewing certificates (Let's Encrypt). Turn it on today.
2. Security headers
Headers are quiet instructions your site sends to the browser telling it how to behave safely. They're invisible to visitors but they're exactly what Chrome — and security scanners — check for.
Run your URL through a free "security headers" scanner. It grades you and lists what's missing. The three that matter most:
Strict-Transport-Security(HSTS) — forces HTTPS so no one lands on an unencrypted version.Content-Security-Policy(CSP) — limits what can run on your page, blocking injected scripts.X-Content-Type-Options— stops the browser guessing file types in unsafe ways.
On WordPress, a security plugin adds most headers with one click. On Squarespace/Wix, HSTS and HTTPS are handled for you. On a custom site, send your developer the scanner report and ask them to "add the missing security headers."
3. Email authentication (SPF, DKIM, DMARC)
This is the check almost every small business fails — and it has nothing to do with your website design. These three records prove that email claiming to be from your domain is really you. Get them wrong and two things happen: your booking confirmations land in spam, and scammers can spoof your business name.
Use a free "DMARC / SPF checker," enter your domain, and read the result:
- SPF — lists who is allowed to send email as you.
- DKIM — a signature that proves the message wasn't tampered with.
- DMARC — tells inboxes what to do with mail that fails the first two.
4. Malware & blacklist status
A hacked site can quietly serve malware to visitors for weeks before you notice, because it often looks completely normal to you when you're logged in. Meanwhile Google flags it and drops it from search.
How to check
Run your domain through a free site-safety scanner (search "Google Safe Browsing site status" or "Sucuri SiteCheck"). It tells you whether you're flagged, blacklisted, or serving known malware.
Don't panic and don't ignore it. Take the site into maintenance mode, restore from a clean backup, change all passwords, then request a review in Google Search Console. This is where having a monitoring tool pays for itself — you find out in hours, not weeks.
5. Privacy & cookie compliance
If you serve UK or EU customers, you need a clear privacy policy, a working cookie banner, and a lawful basis for the data you collect through forms. This isn't just legal box-ticking — visitors increasingly look for it before trusting you with their details.
- Do you have a privacy policy linked in your footer?
- Does your cookie banner actually let people decline non-essential cookies?
- Do your contact forms say what you'll do with the information?
6. Out-of-date software
The single most common way small business sites get hacked isn't a sophisticated attack — it's an outdated plugin, theme, or CMS with a known hole. Attackers scan the web for exactly these.
- Log into your CMS and check for pending updates to the core, themes, and plugins.
- Remove any plugin or theme you're not actively using — every one is a potential door.
- Turn on automatic updates for security releases if your platform offers it.
Grade yourself in 60 seconds
Tally your six checks. Here's a rough read on where you stand:
Want this checked — and re-checked — automatically? Trust Shield runs all six audits continuously, grades your site, and tells you the exact next fix in plain English. It's included with every ranker.bot plan.
- Valid SSL — padlock shows, SSL test grades A/B
- Security headers — HSTS, CSP, X-Content-Type-Options present
- Email auth — SPF, DKIM and DMARC all pass
- Clean & not blacklisted — Safe Browsing shows no issues
- Privacy in place — policy linked, cookie banner works
- Software current — no pending security updates