Try “SSH”, “passkeys”, “WordPress” or “Content-Security-Policy”.
Security Self-Check · runs in your browser
Twelve questions about accounts, updates, backups, devices and email. Get a score and a to-do list sorted by risk, linked to the guide for each step.
01Is multi-factor authentication switched on for email, admin and finance accounts? Critical
02Do all computers, phones and servers install security updates automatically or at least weekly? Critical
03Do you keep one backup copy offline or immutable, and did you test a restore in the last six months? Critical
04Does everyone use a password manager instead of reusing passwords? High
05Does daily work happen in standard accounts without administrator rights? High
06Are laptops and phones encrypted and protected with a screen lock? High
07Do all devices and operating systems still receive security updates from the vendor? High
08Is your website or shop kept updated automatically, served over HTTPS and protected by security headers? High
09Do staff know how to report phishing, and are payment changes always confirmed by phone? High
10Does your domain publish SPF, DKIM and a DMARC policy? Medium
11Do you have written rules for which AI tools may be used and which data must never go into them? Medium
12Are accounts and access removed on the day someone leaves? Medium
Your answers stay in this browser. The score weights critical gaps three times and high gaps twice as much as medium ones.
Read the background
Twelve controls, ordered by impact, that protect a team of one to fifty people against the break-ins that actually happen, from MFA and a password manager to offboarding and an incident contact list.
Critical impact6 min
Attackers routinely exploit flaws that already have a fix. A realistic update routine for small teams: automatic updates, a weekly slot, priorities from the known exploited list, firmware, testing and end of support.
High impact5 min
Free chat app, business plan, API, cloud region or your own server: the deployment type decides who sees your prompts, how long they are kept and what you can prove later.
High impact6 min
More tools
