How to check your website for weak spots before AI attackers do

What should I check on my website first?

Start with the checks an automated attacker would try first: out-of-date software, weak admin logins and exposed files. The seven steps below take an owner about an hour. They do not replace a professional test, which you can read about in what AI penetration testing is.

1. Is everything up to date?

Update WordPress, themes, plugins and your content platform. The WordPress hardening guide says older WordPress versions do not receive security updates and recommends turning on automatic updates. Apply the same rule to any other platform you run. The WordPress security guide goes deeper.

2. Are admin logins protected?

Every admin account should have a long, unique password and two-step verification. CISA advises turning on multifactor authentication for work email, file storage and remote access, starting with admin accounts. It ranks security keys as the strongest method and text codes as the weakest. Also delete accounts for people who have left, and avoid “admin” as a username.

3. Are any files or backups exposed?

Check that nobody can download your backups, configuration files or old copies of the site by typing in an address. Move backup files off the web server. WordPress’s hardening guide says to block direct access to wp-config.php and to store backups with integrity protection, such as encryption or read-only storage. Delete test pages and old installs you no longer use.

4. Does the site use HTTPS everywhere?

Every page should load over HTTPS and redirect plain HTTP visitors automatically. If you use Cloudflare, its Always Use HTTPS setting does this on all plans. Check that your certificate has not expired and that no page pulls in images or scripts over HTTP.

5. Are the security headers set?

Run your address through MDN HTTP Observatory, a free scanner from Mozilla that grades a site’s HTTP headers and related security settings. It has scanned millions of sites since 2016. Its report names missing headers and what each one does. Pass the report to whoever manages your hosting, since headers are set at server level.

6. Are your plugins and tools trimmed back?

Remove plugins and themes you do not use, and install new ones only from trusted sources. WordPress’s guide recommends this, and it also advises reviewing the code of any plugin that asks for write access. Each extra plugin is another thing to update and another possible way in.

If you want an extra filter in front of your site, Cloudflare’s free managed ruleset targets widely exploited vulnerabilities and is available on the Free plan. Treat it as a second layer, not a replacement for updates.

7. Is your PHP version still supported?

Check which PHP version your host runs, and move off any version that no longer gets security fixes. According to the PHP supported versions page, as of 28 October 2026 the supported branches are 8.5, 8.4, 8.3 and 8.2. Version 8.2 gets security fixes only, until 31 December 2026. Our PHP version check shows how to find yours.

How do I know if Google has flagged my site?

Open the Security issues report in Google Search Console. It shows a green tick if there are no issues. Otherwise it lists hacked content, malware or social engineering, with the date each was first detected and sample pages.

What should I do with the results?

Fix in this order: anything that gives access (logins, exposed files), then updates, then headers and tidying. Write down what you changed and the date. Repeat the list monthly, and after any major change to your site.

What about DNS and email settings?

Check that your domain’s DNS records are yours, current and locked down at the registrar. Log in to your registrar and your DNS host, and confirm that two-step verification is on for both, since a stolen registrar login lets an attacker redirect your whole site. Remove records for services you no longer use, such as an old subdomain pointing at a hosting account you have closed.

For email, ask your email provider which sender checks (SPF, DKIM and DMARC) it recommends for your domain, and follow its setup guide. These checks make it harder for someone to send mail that pretends to come from you. CoSA Lab has not verified specific settings here, so use your provider’s own documentation as the reference.

How do I keep the checks from being forgotten?

Put the seven checks in a shared calendar entry once a month, and give one named person the job. Keep a one-page log: date, what was checked, what was changed. A short log also helps if you later hire a professional or need to show a customer what you do. If you want deeper testing once the basics are done, see using AI agents to test your own site, safely.

When should I call a professional?

Call a professional when you handle payments or customer records, when the checks above turn up something you cannot explain, or when Google’s Security issues report shows hacked content. A specialist can clean a compromised site and find how the attacker got in, which a checklist cannot do. Before you call, collect your hosting login details, a list of installed plugins and the dates of your last backups. That saves time and cost, and it lets the specialist start on the real problem straight away.

Keep your own copy of every report and note you produce while working through the list. If something goes wrong later, those notes show what was checked, when, and what state the site was in at the time.