How do I know if my website is secure, without a developer?

Short answer: you can check the common problems yourself from the outside, without touching the server. Most break-ins come from a few things: files that should never be public, old software with known holes, and missing basic protections.

How to check it yourself

1. Check your site opens on https:// with a padlock and no warning.
2. Try /.env and /.git/HEAD on your domain: both should return 404 or 403.
3. On WordPress, open Dashboard, then Updates, and update anything listed.
4. Ask whoever built the site to confirm backups exist and are stored off the server.

What Preventionlabs shows

Every report checks, from the outside and read-only: HTTPS, security headers, cookie settings, script libraries with published security holes, files that should never be public (.env, git, config backups), and on WordPress the version, the plugins it can see and whether user accounts are listed. Each finding comes in plain words with how to fix it. See everything a report checks.

It's an outside check, not a full security audit: it can't see inside your server or your admin accounts.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers

• My AI built my website. How do I know it's working?
• Is my .env file visible to the public?
• Can people see my website's .git folder?
• All questions