Many entrepreneurs only think about their website’s security after a problem. Yet the most frequent risks are easy to spot. Here are 7 points I check first.
The 7 points
- The secure connection: the padlock (https) must appear on every page, and the certificate must not have expired.
- Updates: a forgotten site or plugin is the most common way in.
- Access: a long, unique password, a second verification, and one access per person.
- Forms: visitors’ data must be sent securely.
- Backups: a recent copy, stored elsewhere, and already tested.
- Unused plugins: whatever is not used should be removed.
- Legal pages: legal notice, privacy policy and a cookie banner that lets people refuse.
An honest note
No website is invulnerable. The goal of a diagnosis is to reduce the most common risks and to know what to fix first. The free checklist at the bottom of the page gives you 12 points to tick.
What if I ticked nothing?
Start with access and backups: those are the points where a mistake costs the most. Then update, then clean up.



