Is my website safe?
Many business owners only find out their website has a problem when a customer tells them, or Google shows a warning. You can learn a lot in ten minutes with free tools. Here are the warning signs, the free checks worth running on your own site, and the parts only someone with access to the site can check.
Last updated
The short answer
To check if a business website is safe, look for warning signs such as browser warnings, strange pages in Google, unexpected redirects or new admin users. Then run free checks on your own site: Google's Safe Browsing site status, an SSL test, a security headers scan and an email records check. These only see the site from the outside. Whether the platform and plugins are up to date, backups work and admin accounts are protected can only be checked by logging in.
Why websites get hit
Most attacks on small business websites aren't personal. In July 2026 the Australian Cyber Security Centre warned of a large campaign scanning websites for known weaknesses in website platforms and plugins, and said many small and medium Australian businesses had been affected. Attackers look for out-of-date software and weak logins, then use the site to send spam, redirect visitors or steal form data. A site that's kept up to date and has protected logins is a much harder target.
Warning signs to look for
A browser or Google warning
A red 'deceptive site' page, a 'this site may be hacked' label in search results, or a 'Not secure' message next to your address.
Strange pages in Google
Search for site:yourdomain.com.au and look for pages you didn't make, especially in another language or selling pills, gambling or fake goods.
Visitors sent somewhere else
Customers say they ended up on another site. It often only happens on phones or when people arrive from Google, so you may not see it yourself.
Admin users you don't know
A new administrator account, changed passwords, or emails about logins you didn't make.
Your emails going to spam
Messages from your domain landing in junk, or customers getting invoices that look like yours but aren't.
Hosting complaints
Your host warns about malware, high resource use or spam being sent from your account.
Free checks you can run on your own site
- Google Safe Browsing site status: shows whether Google has flagged your site as unsafe.
- SSL Labs server test: checks your padlock certificate and how it's set up.
- Mozilla Observatory or a security headers scan: checks the security settings your site sends to browsers.
- A DMARC or email records checker: shows whether SPF, DKIM and DMARC are set up to stop scammers sending as you.
- Have I Been Pwned: shows whether email addresses at your domain have turned up in known data breaches.
- Only run these on websites you own or are allowed to check.
What the free checks can't see
- Behind the login. Outside scans can't see whether the platform and plugins are up to date, who has admin access, or whether multi-factor sign-in is turned on.
- Backups. No scanner can tell you whether last night's backup ran, where it's kept, or whether it would actually restore.
- Who controls the domain and hosting. If a former web developer or staff member holds the logins, you could lose the site or the domain. Only the account records show this.
- What it all means. Each tool gives its own grade. Someone still has to decide which findings matter for your business and fix them in the right order.
How WaTo can help
- Our website security and compliance audit combines the outside checks with a look behind the login, and turns it into one red, amber and green list.
- The quick check is $290 ex GST, and the full audit with a fixed price for each fix is $890 ex GST.
- If the site has already been hacked, our website rescue and repair team can clean it up and close the way in.
- WordPress sites are safe when they're kept up to date. Our website maintenance plans do the updates and backups for you.
Website safety questions
How do I know if my website has been hacked?
Look for the warning signs on this page, especially strange pages under your domain in Google, visitors being redirected, or admin users you don't recognise. If you see any of them, our guide on what to do when a WordPress site is hacked explains the first steps.
Is a free website security scan enough?
It's a good start. Free scans check what anyone on the internet can see, like your certificate and security settings. They can't check updates, backups or admin accounts. The attacks in the Australian Cyber Security Centre's July 2026 alert went through known weaknesses in website software and plugins.
Does the padlock mean my website is safe?
No. The padlock means the connection between the visitor and your site is encrypted. A site with a padlock can still be running out-of-date software or be hacked.
Can I scan someone else's website?
Stick to sites you own or have permission to check. Probing other people's systems without permission can break the law.
How often should a website be checked?
We suggest checking for platform and plugin updates at least monthly, and sooner when a security fix comes out. Back up daily or weekly depending on how often the site changes. A full check once a year, or when you change web developer or host, is sensible.
How WaTo can help with this
Guides on this topic
- My WordPress site has been hacked. What do I do first?
- Website maintenance checklist for small business
- How to secure your business domain name
- Free government cyber checks for small business, and what they don't cover
Sources & references
WaTo Consulting. Last reviewed 2026-11-07. Review yearly, and when the free tools listed change.
Not sure what the scan results mean?
Send us your web address and we'll book a fixed-price check that covers the outside and behind the login.
Mon to Fri, 8:30am to 5pm
