Why security is a visibility topic
A business owner hears "security" and thinks hacking. That is the most spectacular risk, but it is not the one that costs the most day to day. What costs the most is the accumulation of small negative signals that weigh on how your site is perceived, by visitors and by machines alike.
Three concrete examples, all measured in our audits:
- Your business emails land in junk because your domain is not authenticated. You blame the content, it is a DNS record.
- Your site shows a warning because of an expired or misconfigured certificate. The visitor closes the tab before reading a single line.
- A backup file sits at the root and downloads for anyone, with your database credentials inside.
None of these three is a hack. All three are invisible from your own browser, and all three are detectable from the outside in thirty seconds.
Project 1: the headers your server sends
On every visit, before the first line of your page, your server sends a series of instructions to the browser. These are the HTTP headers. They tell the browser what it is allowed to do: which scripts to run, whether the page may be displayed in a frame on another site, what information to pass along when leaving.
A site without these headers works perfectly. It simply lets the browser decide on its own, which opens the door to classic attacks such as script injection or clickjacking. The six that really count are detailed in our dedicated article: HTTP security headers explained without jargon.
The point that matters for a business owner: they are all set in the same place, in the server configuration, and a single intervention handles them as a block. It is the best ratio between effort and points gained in an audit.
Project 2: the certificate and encryption
The padlock in the address bar means the connection between the visitor and your server is encrypted. It has been the absolute minimum for years, and Google has treated it as a ranking signal since 2014.
Three mistakes come up constantly:
- The certificate expires. They last three months with Let's Encrypt, a year with most others. Without automatic renewal, forgetting is only a matter of time, and the site becomes unreachable overnight behind a red warning.
- The insecure version stays reachable. The site answers over HTTPS but also over HTTP, with no redirect. Google then sees two identical sites, and the content is diluted across both addresses.
- The certificate does not cover every address. It covers your-site.com but not www.your-site.com, or the reverse. Half your visitors see a warning.
The good news: a free, automatically renewed certificate settles all three, and virtually every host offers it as a single checkbox.
Project 3: authenticate your emails
This is the most profitable project and the most ignored. Without authentication, anyone can send an email that appears to come from your domain, and your own messages stand a good chance of landing in junk.
Three records to publish in your DNS zone, and a policy to tighten gradually. Since February 2024, Google and Yahoo require them from bulk senders: it is no longer a good practice, it is a condition of access to the inbox. The detail is in our article on SPF, DKIM and DMARC.
One telltale sign: if your customers regularly tell you "I did not get anything, I checked my spam folder", the problem is almost never your message.
Project 4: what you expose without knowing
A website publishes more than its pages. Files end up online by accident and stay reachable by anyone who knows their address, with no hacking involved.
What we find most often:
- Backups named site.zip or backup.sql left at the root after a migration.
- Configuration files containing database passwords or access keys to third-party services.
- Directory listing: a folder without an index page displays its entire contents to anyone who guesses the address.
- Administration interfaces left open after a contractor finished the job.
This is the category where the risk is not theoretical: these addresses are probed constantly by automated bots, which do not need to target you to find you.
Where to start, concretely
In this order, because it goes from the most severe to the least and from the fastest to the slowest:
- Exposed files. The only project where a single defect can bring your business down. Half an hour.
- The certificate and the redirect. Visible to every visitor, and a ranking signal. One hour.
- HTTP headers. One intervention, many points gained. One hour.
- Email authentication. The longest because you must observe before tightening, but the most profitable commercially. A few days of observation.
Our free audit measures these four projects from the outside, exactly as a visitor or a bot would, and tells you which ones are open on your site. Our methodology details what we measure and, just as importantly, what we refuse to measure: we run no port scans and no intrusive probes.
Romain Ben