A website check for businesses regularly verifies whether the company website is technically up to date, shows no obvious security vulnerabilities to the outside world and whether mandatory pages such as the legal notice (Impressum) and the privacy policy can be reached. The following ten points show what matters – and what you can assess well even without IT knowledge.
Why a regular look is worthwhile
A website changes even when nobody deliberately changes anything on it. Software receives updates, certificates expire, a new plugin brings a tracking service with it. What was fine when the website was launched may look different a year later. A website security check from the outside notices such changes before customers or partners stumble across them.
The 10 points at a glance
You can use the following list like a checklist next to your own website.
1. Encrypted connection
Your website should only be accessible via HTTPS, i.e. via an encrypted connection. The padlock symbol in the browser shows this. If the certificate has expired, browsers clearly warn visitors – not a nice first impression.
2. Up-to-date software
The content management system (the software you use to maintain content), themes and plugins should be up to date, as many updates close known security vulnerabilities. You can read more about this in the guide how to recognise outdated plugins and expired certificates.
3. No exposed files
Backups, configuration files or old test pages do not belong on the public internet. Sometimes they can be accessed via a simple address without anyone noticing.
4. Security headers
Security headers are short instructions from the server to the browser, such as “do not embed this page in other pages”. They take little effort and make some attacks more difficult.
5. Legal notice accessible and complete
The legal notice should be accessible with one click from every page and contain the mandatory information required by the DDG (Digitale-Dienste-Gesetz, the German Digital Services Act). Exactly which details are required depends, among other things, on the legal form.
6. Privacy policy accessible
The privacy policy should also be easy to find everywhere. It describes which personal data your website processes; the basis for this is the GDPR (in German: DSGVO).
7. Cookie banner and trackers
The question of whether a cookie banner is mandatory essentially comes down to whether your website embeds services for which visitors have to give consent, such as analytics or advertising services. A common finding in checks: trackers already load before anyone has agreed in the banner. Whether a banner is needed, and in what form, depends on the services used; the main rules here are the TDDDG (the German Telecommunications Digital Services Data Protection Act) and the GDPR.
8. Accessibility
People with visual or hearing impairments should be able to use your website, for example thanks to sufficient contrast, alternative texts for images and keyboard operation. Anyone wanting to check the accessibility of their website will quickly come across the BFSG (Barrierefreiheitsstärkungsgesetz, the German Accessibility Strengthening Act). Whether it applies to your business depends on what you offer and on the size of the business – if in doubt, you should have this clarified.
9. Loading time and findability
If a page loads slowly, visitors leave. If page titles or descriptions are missing, search engines find it hard to classify your content correctly.
10. Email security with SPF, DKIM and DMARC
SPF, DKIM and DMARC take care of email security – three entries in the DNS, the address book of the internet. SPF specifies which servers may send on behalf of your domain, DKIM adds a digital signature to emails, and DMARC tells the recipient how to handle emails that fail these checks. This makes forged emails with your sender address more difficult, and your genuine emails end up in the spam folder less often.
What you can check yourself – and what is better left to a tool
You can recognise some of the ten points at a glance: is the padlock symbol there, and can you find the legal notice and privacy policy in the footer of every page? Other points, such as security headers, exposed files or DNS entries, can only be checked meaningfully with technical tools.
For legal topics, the following applies: a technical check shows notes and possible deficiencies, but does not replace legal advice. For an assessment of the individual case, a lawyer is the right point of contact. You can read which formal points are often noticed in legal texts in the guide common possible deficiencies in the legal notice and privacy policy.
Checked regularly with PlugTheBug
PlugTheBug checks company websites regularly from the outside – and only what is publicly accessible. No login details are needed for this, and nothing is changed on your website. The measurement is automated, every finding is measured a second time, and only what really matters ends up in the report.
- Basic Check (9 € per month): a short, regular check of the essential security and legal issues. You are only notified if something is noticed.
- Full Check (16 € per month): a detailed check with a clear PDF report including a traffic-light rating, covering accessibility, loading time, search engines and email security.
PlugTheBug checks legal texts formally, i.e. whether mandatory information is present and accessible; a legal assessment is not included. If you would like to know where your website stands, request a check of your website or take a look at the packages and prices.