Website Security Checklist: 10 Checks You Can Do Yourself

A website security check is a routine review of the things attackers most often walk through: unencrypted connections, guessable admin passwords, outdated software, and leftover files you never put there. The ten checks below take about an hour, cost nothing, and need no special technical background.

Why it matters: Indonesia’s national cyber agency BSSN recorded 5.5 billion cyber attacks against Indonesia in 2025 alone, more than seven times the 2020–2024 annual average (Antara, 2026), and defacement (pages replaced or vandalized) is the most common type. Most of those attacks are not sophisticated — they come through a door someone forgot to lock.

1. HTTPS is live on every page

Open your site and look at the address: it must be https://, not http://. If any page still runs on HTTP, browsers show a “Not secure” warning and form data (names, phone numbers, passwords) travels across the internet unencrypted.

Check yourself: load https://yourdomain.com — the padlock should appear with no mixed-content warnings. If one shows up, some image or script is still loading over HTTP.

2. Admin logins that can’t be guessed

Username admin with password admin123 is the first combination attackers’ bots try — millions of automated login attempts hit WordPress sites daily. Change default usernames, use a unique password (a password manager helps), and enable 2FA on every admin account.

Check yourself: how many people know your admin password right now — including former staff and old vendors? Revoke access that outlived its purpose.

3. Software is actually updated

Old plugin, theme, or CMS versions have publicly documented holes — CVEs (official vulnerability identifiers) that attackers watch, with tools scanning the whole internet for unpatched sites. The update you keep postponing because “it’s annoying” closes the most commonly exploited gaps.

Check yourself: how many updates are pending in your CMS dashboard right now? If the answer is “lots, and I don’t remember when we last updated” — that’s your first finding.

4. Search Google for pages that aren’t yours

Attackers who inject hidden pages (gambling, illegal pharma) into your site rarely make them visible on the front end. Google usually knows first.

Check yourself: search site:yourdomain.com and open the results one by one. Gambling pages, pharmacy links, or a language that isn’t your business’s language? That’s malware injection — act now, not later.

5. Backups you can actually restore

An untested backup is a fire extinguisher nobody has ever opened. A real backup is: scheduled, stored off the web server (same server means the attacker deletes it too), and proven by at least one test restore.

Check yourself: when was your last backup taken, and who can prove a restore worked? If nobody can answer, treat the site as having no backup.

6. Admin panels shouldn’t be public doors

/wp-admin, /phpmyadmin, login pages — reachable from the internet with no extra layer, they are permanent brute-force targets. Simple layers (IP protection, rate limiting, at minimum a real password) drop the odds dramatically.

Check yourself: open yourdomain.com/wp-admin (or your login page) from your phone on mobile data, not office WiFi — does the form appear immediately? Note that as a risk.

7. The site looks the way you left it

Defacement — homepage replaced by a hacker message or gambling ads — is BSSN’s most frequently reported attack type. Sometimes it flickers on at odd hours while your team isn’t watching.

Check yourself: open the homepage from another device (phone, a colleague’s laptop) and compare with the Wayback Machine: anything changed that you didn’t do?

8. Visitor data is stored properly

If your site stores personal data — contact forms, member areas, checkout — verify passwords are hashed (not plain text) and sensitive values don’t end up in logs. For Indonesian businesses, the PDP law (Law 27/2022) requires proper personal-data handling, including notifying authorities within 3×24 hours after a breach.

Check yourself: ask your developer or agency: “what hashing do member passwords use?” If the answer wanders, that’s a red flag.

9. Traffic and logs don’t whisper on their own

Analytics spikes toward pages you don’t own, error logs suddenly full, files changing their own modification dates when nobody uploaded anything — that’s the server raising its hand.

Check yourself: once a month, open your analytics. Unexplained traffic from unknown sources, or landing pages that aren’t yours?

10. Know your limits — when to bring a professional

These ten checks catch what is visible from outside. What isn’t — backdoors planted inside code, leaking server configuration, holes in a custom application — needs someone who does this for a living (a security audit). If your site holds money or customer data, an annual audit is proportionate; right after a hack, one is part of recovery, not an upsell.

Frequently asked questions

How long does doing this myself take? About an hour for all ten, if you have every access (hosting, admin, analytics) at hand. After that, the routine is 10–15 minutes a month.

I use popular hosting — do I still need these checks? Yes. Good hosting secures the server; your pages, logins, and plugins are still your responsibility. Plenty of incidents happen on expensive hosting with a weak admin password.

My site was hacked before and cleaned. Am I safe? If the entry point was never found and closed, repeat incidents are the norm within months. Cleanup without a root-cause audit is mopping a floor that’s still leaking.

---

If any point above made you uneasy — or your site is in trouble right now — start with the emergency steps for a hacked website, or talk to us directly via the security audit service or contact. Real-world evidence of this work: the IAC infrastructure case study.