Po polsku

Is my website safe?

You run a website and want to know whether it is safe. Type its address below. In about 90 seconds ShieldWave shows you what anyone on the internet can see about your site's security, in plain language. The first check is free and needs no account and no password.

Want to know whether a shop or a link is safe before you buy or click? This check is not for that. It is for people who run the site. For a site you do not know, Google's Safe Browsing site status shows whether Google has flagged it.

What the check looks at

The check sees your site from the outside, the way a visitor or a bot does. It needs no plugin, no password and no access to your hosting.

The free check without an account is the quick check:

• The certificate. Whether it is valid, when it expires, and whether pages load over a secure connection.
• Browser protections. The security headers and cookie settings that stop other sites from framing your pages or taking over a login session.
• How the site is built. The WordPress version and the plugins and themes your home page loads, compared with public lists of known security holes.

With a free account, once you confirm that the site is yours, the full check runs more than 20 checks. It adds forms that accept input they should refuse, malware, spam links and redirects in the pages, forgotten backups and configuration files anyone can download, email settings (SPF, DKIM and DMARC), open ports and old subdomains. You confirm the site with a DNS record, a file on the site, a tag in the page's code or our WordPress plugin. It takes a few minutes and needs no password.

The report sorts what it finds into this week, this month and later. The free plan shows the score and the three most serious problems. The full report adds every finding and a brief you can forward to your developer.

What it cannot see

• Files on your server. A backdoor in a PHP file that leaves no trace in the page is invisible from the outside. On WordPress our free plugin checks the files from the inside. On other systems, ask your hosting company for a malware scan of the files.
• Accounts and passwords. How many administrators you have, whether they use weak passwords, whether two-step login is on.
• Content in the database. Spam added to old posts that shows up only on a few pages.
• How your shop or application works. Whether a customer can see someone else's order by changing a number in the address. That takes a person in a penetration test.

A good score means the outside checks found little. It does not prove the site is safe. ShieldWave also does not fix or clean anything: it tells you and your developer what to fix.

If your site runs on WordPress, read the WordPress security check: it explains what the free plugin sees that the outside check cannot.

Signs your site may already be hacked

A hacked site rarely looks hacked. Whoever got in wants to use it for as long as possible, so the site keeps working. Look for these:

• A customer says your site sent them to a lottery, a fake shop or a warning that their phone is infected, and you cannot reproduce it. Malicious redirects often show only on phones, only to visitors from Google, and only now and then.
• Searching site:yourdomain.com in Google lists pages nobody on your side created: text in Japanese, pharmacy, casino or fake brand goods.
• Google shows "This site may be hacked" next to your site, or Chrome shows a red warning page. Google Search Console lists what it found under Security issues.
• An administrator account you do not recognise, or a plugin nobody installed.
• Your hosting company writes about malicious files, a blocked account or unusual server load.
• Your emails bounce with a blacklist notice or land in customers' spam.
• Google Ads rejects your ads for malware or a compromised landing page.

One sign alone settles nothing. Two at once is a reason to act today. The article Signs your website was hacked goes through each one.

What to do next

1. Run the check above. If it finds problems, start with the ones under "this week" and forward the developer brief to whoever looks after your site.
2. On WordPress, install the free plugin. Ensomedia Security is on WordPress.org and checks files, accounts and settings from the inside, with no account and no limits.
3. If you think the site was hacked, delete nothing yet. Write down what you see, with screenshots and times. Change the passwords for the hosting panel, the site's administrators, FTP and the mailboxes on your domain, and turn on two-step login. Ask your hosting company to keep the server logs and copy the site before anyone cleans it. Cleaning the site is work for your developer or hosting company.
4. Think about personal data. If the site holds customer data and someone got in, under GDPR you have 72 hours from finding out to report a personal data breach to your data protection authority, unless it is unlikely to put people at risk.

Back to the free check