FOR SMALL BUSINESSES AND FOUNDERS
Is my website secure?
Seen from the outside, three things matter most: the site is encrypted, browsers are told to always use the encrypted version, and nothing private can be downloaded from it, like a code folder, a password file or a backup. You can check the first one yourself in a minute. Liaison checks all three every week, plus 16 more, and gives you a badge for your site when it passes. It’s free.
Checking it yourself
Only try these on a site that is yours.
- Encryption (HTTPS). Type
http://followed by your domain into the browser, without the s. You should land on thehttps://address with a padlock. If the address stays onhttp://or the browser says “Not secure”, anything typed into your forms travels in the clear. - Always encrypted (HSTS). This one is a header the server sends, so you can’t see it on the page. In Chrome, open the developer tools, go to Network, reload, click the first line and look for
strict-transport-securityunder the response headers. Without it, someone on the same café Wi-Fi as your visitor can push them back to the unencrypted version. - Exposed files. Add
/.envto the end of your domain, then try/.git/HEAD. Both should give an error page. If either one downloads a file or shows text, the site is handing out its settings or its source code, often with passwords inside. Tell whoever built the site that day.
Why once isn’t enough
A site that passes today can fail next month. A plugin updates, the host changes a setting, a developer leaves a backup in a public folder while fixing something. Nobody tells you, because nothing looks different on the page.
Liaison checks the site again every week from outside, the way a visitor’s browser sees it. If something stops passing, you get an email that says what it is and how to fix it. If it still fails three checks in a row, the badge on your site turns grey by itself, so it never claims something that has stopped being true.
The other 16 checks cover security headers, cookies, mixed content, outside scripts, version banners, folder listings, the certificate’s expiry date, old encryption versions, database ports open to the internet, email spoofing (SPF and DMARC), security.txt, DNSSEC, CAA, mail encryption, the domain’s renewal date and the WordPress version. The full list, in plain words.
What an outside check can’t see
It doesn’t log in, try passwords or attack anything, so it can’t tell you whether your staff use two-step login, whether old employees still have access, or whether the office computer is up to date. Those decide just as much. The 15-minute security check walks you through them for your own setup, also free.
Questions
Is the padlock in the address bar enough?
The padlock only means the connection between the visitor and your site is encrypted. It says nothing about files left in public folders, outdated software or settings the server sends.
Does the Liaison check touch my site?
It reads what any visitor’s browser could read: the pages, the headers and a short list of addresses where private files often end up. No logins and no attack attempts. It runs once a week, and daily while something is failing, so you hear quickly when it’s fixed.
How do I prove the site is mine?
Use an email address at your website’s domain when you ask for the badge, and click the link Liaison sends you. That is the proof. With an address elsewhere, you get a short code to add to your domain instead.
What does it cost?
Nothing. The check, the badge and the weekly emails are free.
What happens if my site fails?
You get an email with what failed and how to fix each item. Nobody else sees the failures: the public page for your badge only ever shows what passed.