How to Check a Website's Security — Complete Guide 2026

By Tibzi Team — 2026-03-03T14:39:23.785Z

Website security isn't just a developer's job. It's a business necessity. A compromised site can leak customer data, get penalized by Google and wipe out trust that took years to build. In this complete guide, we show you exactly how to check the security of any website, step by step, using free tools.

This guide covers 20 critical points to check, from the SSL certificate to your email configuration. Whether you're a site owner, a developer or a marketing specialist, you'll find information you can use right away.

Why website security matters

Before we get into the technical details, let's look at why web security is essential:

  • Google penalizes insecure sites: since 2018, Chrome has flagged every site without HTTPS as “Not secure”. Since 2021, Core Web Vitals (which also include security) have been a ranking factor.
  • The cost of an attack is enormous: according to IBM research, the average cost of a data breach in 2025 was USD 4.88 million globally. For Romanian SMEs, even a minor attack can mean days of downtime and losses of thousands of euros.
  • GDPR requires security: Article 32 of the GDPR obliges data controllers to implement “appropriate technical and organisational measures”. Poor security can lead to fines of up to EUR 20 million.
  • Customer trust: 85% of consumers wouldn't buy from a site that doesn't have HTTPS. The green padlock in the browser is a universal sign of trust.

1. Check the SSL certificate/HTTPS

The SSL (Secure Sockets Layer) certificate is the first and most visible security element. It encrypts the communication between the visitor's browser and your server.

What to check:

  • The certificate is valid: issued by a recognized certificate authority (Let's Encrypt, DigiCert, Sectigo)
  • It hasn't expired: Let's Encrypt certificates expire after 90 days, commercial ones after 1 year
  • The TLS protocol: it must be TLS 1.2 or TLS 1.3. TLS 1.0 and 1.1 are deprecated and vulnerable
  • Forward secrecy: ensures past sessions stay protected even if the server's key is compromised in the future
  • Key strength: at least RSA 2048-bit or ECDSA 256-bit
  • Secure ciphers: no RC4, DES, 3DES or other deprecated ciphers

How to check: Use our free SSL check tool, which analyzes all of these aspects and gives you plain-language recommendations. Alternatively, Qualys SSL Labs offers a detailed technical analysis.

2. Check the HTTP security headers

Security headers are instructions the server sends to the browser to prevent common attacks. Visitors never see them, but they're essential for security.

The critical headers:

  • Strict-Transport-Security (HSTS): forces the browser to use HTTPS only. Without HSTS, an attacker can force an unsecured HTTP connection (a downgrade attack). Recommended value: max-age=31536000; includeSubDomains
  • Content-Security-Policy (CSP): the most powerful security header. It specifies exactly where the browser may load scripts, styles, images and other resources from. It prevents XSS (Cross-Site Scripting) attacks.
  • X-Frame-Options: prevents clickjacking (where an attacker embeds your site in an invisible iframe). Recommended value: DENY or SAMEORIGIN
  • X-Content-Type-Options: prevents MIME type sniffing. Value: nosniff
  • Referrer-Policy: controls how much information about the source page is sent when users navigate away. Recommendation: strict-origin-when-cross-origin
  • Permissions-Policy: controls access to browser APIs (camera, microphone, geolocation). It blocks features you don't use.

How to check: The Tibzi security check analyzes all the headers and tells you exactly what's missing and how to configure each one.

3. Scan for open ports

Every open port on the server is a potential entry point for attackers. A properly configured web server should expose only the ports it strictly needs.

Normal vs. dangerous ports:

  • Port 80 (HTTP) and 443 (HTTPS): normal for a web server
  • Port 22 (SSH): needed for administration, but it should be protected with key-based authentication, not passwords
  • Port 3306 (MySQL): dangerous if it's public. Your database should never be reachable from the internet
  • Port 21 (FTP): an insecure protocol that should be replaced with SFTP (port 22)
  • Ports 8080, 8443: may point to development apps or exposed admin panels

A port scan isn't hacking: you're only checking which services are publicly visible. It's like checking whether the doors and windows of your house are locked.

4. Detect the firewall (WAF) and CDN

A Web Application Firewall (WAF) filters malicious traffic before it reaches your server. A CDN (Content Delivery Network) adds an extra layer of protection.

Popular WAFs:

  • Cloudflare: the most popular, with WAF + CDN + DDoS protection on the free plan
  • Sucuri: specialized in WordPress security
  • AWS WAF: for applications hosted on Amazon Web Services
  • ModSecurity: an open-source WAF, available for Apache and Nginx

Why it matters: without a WAF, your server receives all traffic directly, including SQL injection, XSS and brute-force attempts. A WAF automatically blocks the most common attacks.

5. Check your reputation on blacklists

If your domain or your server's IP shows up on blacklists, the consequences are serious:

  • Your emails land in spam: mail servers check blacklists before accepting messages
  • Google may show warnings: “This site may be dangerous” appears in the search results
  • Browsers may block access: Chrome and Firefox use Google Safe Browsing to warn users

Important blacklists to check:

  • Spamhaus (SBL, XBL, PBL)
  • SURBL
  • Barracuda Reputation
  • UCEPROTECT
  • Google Safe Browsing

Our security test automatically checks whether your domain appears on the main blacklists.

6. Detect information leaks

Many websites unintentionally expose information that helps attackers:

  • The Server header: shows the Apache/Nginx/LiteSpeed version, so an attacker knows exactly which vulnerabilities to exploit
  • The X-Powered-By header: exposes the PHP, ASP.NET or framework version. It should be removed
  • Detailed error pages: stack traces, file paths and library versions shown on 500 error pages
  • Exposed files: .env, wp-config.php.bak, .git/, phpinfo.php
  • HTML comments: developers sometimes leave comments with sensitive information in the source code

The golden rule: an attacker shouldn't be able to tell what software you run, which version, or how it's configured. The less they know, the safer you are.

7. Check your email configuration (SPF, DKIM, DMARC)

Email security is often neglected, but it's crucial. Without proper authentication, anyone can send fake emails in your domain's name (email spoofing).

The 3 essential protocols:

  • SPF (Sender Policy Framework): a DNS record that specifies exactly which servers are allowed to send email for your domain. Without SPF, your emails will often land in spam.
  • DKIM (DomainKeys Identified Mail): adds a cryptographic signature to every email you send, so the recipient can verify the email wasn't modified in transit.
  • DMARC (Domain-based Message Authentication): the policy that tells recipients' servers what to do with emails that fail the SPF/DKIM checks: accept, quarantine or reject.

How to check: Use our email check tool, which analyzes SPF, DKIM, DMARC, MTA-STS, BIMI and MX records, all free and with plain-language explanations.

8. Check GDPR compliance

Security and data protection are closely linked. A website that collects personal data has to comply with GDPR:

  • Privacy policy: reachable from every page, with information about the controller, the purposes and users' rights
  • Cookie consent: a banner with options to accept, reject and customize
  • Company details displayed: CUI (tax ID), Trade Register number, registered office (mandatory under Romanian e-commerce law, Law 365/2002)
  • ANPC link and SAL pictogram: mandatory for e-commerce sites (ANPC is Romania's consumer protection authority; the SAL pictogram is its alternative dispute resolution pictogram, linking to reclamatiisal.anpc.ro)

Check all of these automatically with our GDPR check tool.

9. Test performance

Website performance is indirectly linked to security:

  • A slow site may signal a DDoS attack in progress
  • Insecure third-party resources can slow the site down and introduce vulnerabilities
  • Missing compression may point to a faulty server configuration

Test your website's performance with our free tool: it covers Core Web Vitals, TTFB, compression and carbon footprint.

10. Check accessibility

Web accessibility isn't just a legal obligation (the European Accessibility Act, since June 2025). It's also an indicator of technical quality. An accessible site is usually more secure too, because it reflects attention to technical detail.

Test it with our accessibility check tool: WCAG 2.1 AA compliance, headings, alt text, ARIA landmarks, contrast.

Quick checklist: 20 points to check

Use this list for a quick security check of any website:

  1. Valid, unexpired SSL certificate
  2. TLS 1.2 or 1.3 protocol
  3. Forward secrecy enabled
  4. HSTS header configured
  5. Content-Security-Policy present
  6. X-Frame-Options set
  7. X-Content-Type-Options: nosniff
  8. Referrer-Policy configured
  9. Only ports 80 and 443 public
  10. WAF or CDN active (Cloudflare, Sucuri, etc.)
  11. Domain clean on blacklists
  12. No software versions in headers (Server, X-Powered-By)
  13. Sensitive files inaccessible (.env, .git, wp-config.php.bak)
  14. SPF configured correctly
  15. DKIM active
  16. DMARC with a policy of at least quarantine
  17. Privacy policy accessible
  18. Working cookie consent
  19. Company details displayed (CUI, Trade Register number)
  20. Working HTTP → HTTPS redirect

Free check tools

For a quick and complete check, we recommend:

What to do if you find problems

Once you've identified the vulnerabilities, here are the remediation steps in order of priority:

  1. Urgent (fix immediately): expired SSL certificate, open database ports, exposed sensitive files
  2. Important (fix within 1-2 days): missing security headers, SPF/DKIM/DMARC not configured
  3. Recommended (fix within 1-2 weeks): WAF not active, visible software versions, permissive DMARC policies

If you need help fixing the problems you've found, our team of specialists can help you implement every security measure correctly.

Conclusion

Website security isn't a one-time project. It's an ongoing process. Technologies evolve, attacks get more sophisticated and standards are updated. We recommend running a full check at least once a month, and every time you make significant changes to your site.

Start now with a free full audit: we check 27 aspects of your website and send you a detailed PDF report with the problems we find and concrete recommendations.