Would Your Website Pass a One-Minute Security Check?

Short answer first: a website is software, and old software gets broken into. The fix is not a special product. It is three habits: the site answers on a secure address, someone puts updates on regularly, and someone keeps a backup they have actually tested.

If nobody has walked you through this before, it is fixable. This page gives you the one-minute check, the two questions to ask, and what the answers should sound like.

Why does an old website get broken into?

Because the instructions for breaking in are public. When WordPress fixes a security problem, it ships a new version. WordPress’s own security guide spells out what happens next: once a fix is released, “the information required to exploit the vulnerability is almost certainly in the public domain.” A site still running the old version is running a lock whose weakness has been published.

The same guide is blunt about old versions: “Older versions of WordPress are not maintained with security updates.” And it treats plugins the same way: “make sure your plugins are always updated. Also, if you are not using a specific plugin, delete it from the system.”

This is not only a WordPress problem. The Federal Trade Commission’s cybersecurity basics for small businesses start in the same place: “Update software and back up files regularly.” WordPress is simply the example with the clearest published guidance.

What does “Not secure” in the address bar mean?

It means the page is traveling over plain http:// instead of https://. The “s” stands for secure: with it, what a visitor types and sees is encrypted between their device and your site. Without it, that traffic can be read along the way by others on the network.

Google made this visible in 2018. From Chrome 68 on, pages that load over plain http show a “Not secure” label next to the address. Your visitors see that label before they read a word of your page.

Setting up https is usually a job for whoever manages your hosting. The part that often gets missed is the redirect: the site should send anyone who types the old http:// address straight to the https:// one, by itself.

The one-minute check — run it now

On your phone, no login needed:

• 1. Type your address starting with http:// — with no “s”. For example, http://yourbusiness.com.
• 2. Watch the address bar. It should switch to https:// on its own, and there should be no “Not secure” warning.
• 3. Try one more page the same way, such as your contact page. Every page should behave the same.

If you see “Not secure”, or the address stays on http://, your visitors see that too. It is usually a quick fix for whoever manages your hosting.

The two questions to ask whoever runs your site

The address bar can’t tell you whether the site is kept up. For that you have to ask. Two questions, and what a good answer sounds like:

1. “When were the updates last put on?” A good answer is a date, and the name of the person who did it. If nobody can give you a date, that is your answer.

2. “When was the last backup — and has anyone ever restored one?” A good answer is a recent date, where the copies are kept, and yes to the second half. WordPress’s backup guide says to “back up your database regularly, and always before an upgrade,” and recommends keeping several recent copies “stored in different locations.”

The second half of that question is my rule of thumb, not an official requirement: a backup nobody has ever restored is a hope, not a plan. You only find out whether it works on the day you need it, and that is the worst day to find out.

What does a well-kept website look like?

• Every page opens as https://, with no warning, and the http:// address forwards there by itself.
• Updates go on regularly, and a named person does them — the core software, the theme and every plugin, with unused plugins removed.
• Recent backups exist in more than one place, and someone has actually restored one.

The update habit, the unused-plugin rule and keeping backups in more than one place come from the sources below. The https redirect, the “named person” and “actually restored one” are my own standard. Plenty of sites run for a while without them and come out fine — until the day they don’t.

What this check does not tell you

Worth saying plainly:

• It is not a security audit. Passing it means the basics are in place. It does not mean the site can’t be attacked.
• It says nothing about passwords or who has logins. Who can sign in, and whether those accounts use strong passwords, is a separate check. Who Owns Your Website? covers the logins that matter most.
• It does not cover your email, even when your email runs on the same domain.
• The free scan does not measure this either. It reads what a visitor and a search engine can see on your pages; it can’t see your update history or your backups.

I ran Artifex Web through this

Typed with http://, my address switches to https:// on its own — I checked again on 2026-09-26. There are no plugins to fall behind: the site is custom-coded, not built on a plugin stack. And every change I make is saved in a history I can roll back to.

Your turn: type your address with http:// today. It takes a minute, and it tells you whether the first habit is in place.

Every source below was opened and re-checked on 26 September 2026. The WordPress handbook pages show a last-updated date; Google’s announcement is dated 24 July 2018. None of this guarantees your site can’t be attacked.