Website Security and Speed Audit Checklist for Kenyan Businesses

A hacked website rarely announces itself. There is no alarm. The owner usually finds out from somebody else: a customer who says the site redirected them somewhere strange, a Google result carrying a warning, or an email from the host saying the account is suspended.

A slow website is quieter still. Nobody complains. People simply leave before the page finishes loading, and the enquiries that should have come in never do.

This checklist is the audit we run on a site before we take it on, written so you can run it yourself. Set aside about an hour. You need your website login, your hosting login, and the free tools listed below. You do not need to be technical to find the problems; you may need help to fix some of them.

The Free Tools You Need

Part 1: Security Checks

1. HTTPS works everywhere

Type your address starting with http:// and check that it jumps to https://. Do the same with and without www. Then check the certificate renews automatically, because an expired certificate puts a full-page warning in front of every visitor. While you are there, open a few pages and look for a padlock warning, which usually means an image or script is still loading over plain HTTP.

2. Google does not flag your site

Search your domain on the Safe Browsing site status page. Then open Search Console and look at Security issues and Manual actions. Both should be empty. If Search Console is not set up for your site, that is itself a fail: you have no way to hear from Google when something goes wrong.

3. The software is current

On WordPress, check the core version, every plugin and the theme for pending updates. Then ask your host which PHP version the site runs and compare it with the versions PHP still supports. A PHP version past its end of life no longer receives security fixes, however current your plugins are.

4. Nothing unused is left installed

A deactivated plugin or theme is not gone. Its files still sit on the server, and a vulnerability in them can still matter. Delete anything you are not using.

5. Admin accounts are few, current and protected

• List every user with admin rights. Remove former staff and old agencies.
• Give people the lowest role that lets them do their job. A blog writer does not need to be an administrator.
• Every admin has a strong, unique password and two-factor authentication.
• Repeated failed logins are limited or blocked, not allowed forever.

6. Backups exist, live somewhere else, and restore

Three questions. Are backups automatic? Are they stored away from the hosting account, so a hacked or suspended account does not take the backups with it? And has anyone ever restored one? A backup nobody has tested is a hope, not a backup.

7. The accounts around the website are locked down

Your domain registrar, hosting and DNS logins control the website completely. Turn on two-factor authentication on all three. Check the domain is registered in your business's name, not a former developer's, and that it is set to renew automatically.

8. The site sends basic security headers

Run your site through the Mozilla HTTP Observatory. These are instructions your server gives the browser, and most small sites send none. For reference, this is what wpfoss.ke itself sends on every page:

Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Content-Security-Policy: frame-ancestors 'self'

In order, they tell the browser to always use HTTPS, not to guess file types, to limit what your URLs reveal to other sites, to refuse camera, microphone and location access, and to refuse to load the site inside someone else's frame.

9. Forms are protected from spam and abuse

Every contact and quote form should have some protection. On our own forms that is three layers: a hidden honeypot field bots fill in and people do not, a rate limit, and Google reCAPTCHA. At least one layer is the minimum.

10. Your domain's email is authenticated

Check that SPF, DKIM and DMARC records exist for your domain. Without them, anyone can send email that appears to come from your address, and your own contact form notifications are more likely to land in spam. Our Google Workspace setup guide shows what each record looks like.

11. Someone is told when the site goes down

If the answer to "how would we know the site is down?" is "a customer would tell us", this is a fail. A free uptime monitor emails you within minutes.

Part 2: Speed Checks

12. You tested on mobile, not only desktop

Run the speed test and read the mobile result first. Desktop scores flatter almost every site. Where Google has enough real visitor data for your site, PageSpeed shows it separately from the lab test; the real data is what matters.

13. The Core Web Vitals pass

Google publishes a "good" threshold for each, measured at the 75th percentile of real page loads:

The thresholds are Google's, from web.dev.

14. The server answers quickly

Before a single image loads, the server has to respond. Our Website Checkup flags a response slower than 1.2 seconds. A slow response usually points at the hosting plan, missing page caching, or a database that needs attention, and no amount of image compression fixes it.

15. Images are sized and compressed

The most common speed problem we find is a phone photo uploaded straight to the site: thousands of pixels wide, several megabytes, shown in a box a few hundred pixels across. Resize images to the size they display at, use a modern format such as WebP, and lazy-load images further down the page. Do not lazy-load the main image at the top, because that delays the very thing LCP measures.

16. Pages are cached

A page that is rebuilt from the database on every visit is slower than one served from a cache. Check that page caching is on, and that browsers are told to keep static files like images, CSS and fonts rather than download them again.

17. Fonts are not holding the page up

Web fonts loaded from another company's server cost extra connections before any text appears. When we moved this site's fonts from Google Fonts to our own server, preloaded them and stopped text re-flowing when they arrived, layout shift fell by 0.175 and the mobile score rose 19 points. Use two font families at most, and host them yourself where you can.

18. Third-party scripts earn their place

Chat widgets, trackers, sliders, social feeds and analytics each add weight, and each runs code on your visitor's phone. List every one and ask what it is for. We measured one analytics script on this site adding about 609 milliseconds on mobile. That is not a reason to remove analytics, but it is a reason to know the cost of what you install.

19. The page is not bloated

Our checkup flags a page whose HTML alone is over 200 KB, which usually means a page builder or theme has piled up code. Look at how many plugins load files on every page, including pages that do not use them.

20. You tried it on a real phone on mobile data

Office Wi-Fi on a new laptop is not how your customers see your site. Open it on an ordinary Android phone, on mobile data, with Wi-Fi off. Time how long until you could actually tap the button you care about.

Signs You Have Already Been Hacked

If you see any of these, stop the audit and deal with it first:

• Admin users you do not recognise
• Visitors, especially from Google, being redirected to another site
• Pages you never wrote appearing when you search site:yourdomain.co.ke on Google
• A warning in Search Console's Security issues report, or on the Safe Browsing site status page
• Your host suspending the account or reporting unusual activity

What to Fix First

1. Any sign of a hack. Everything else waits.
2. Backups. Before you change anything else, make sure you can undo it.
3. Outdated software and unused plugins. The most common way in.
4. Admin accounts and two-factor authentication, on the site, hosting, registrar and DNS.
5. HTTPS, headers and email authentication.
6. Speed, starting with server response and images, which usually give the biggest gains for the least work.

The Checklist on One Page

For the ongoing version, what to check daily, weekly and monthly after the audit is done, see the website maintenance checklist. For more detail on each speed fix, read 14 speed optimisation tips that actually work.

Having It Done for You

An audit finds problems. Keeping them fixed is monthly work, and that is what our maintenance plans are for. Every plan includes software updates tested before they go live, daily malware scans, daily off-site backups, uptime checks every 5 minutes, SSL certificate management, and malware removal if the worst happens.

Month-to-month, cancel any time. Details are on the website maintenance page.

Frequently Asked Questions

How often should I audit my website's security and speed?

Run this full checklist at least every three months, and after any big change such as a redesign, a new plugin, a hosting move or a staff member leaving. Backups, updates and uptime need watching continuously, not quarterly.

How do I know if my website has been hacked?

Common signs are admin users you did not create, visitors being redirected to other sites, pages you never wrote appearing in Google when you search site:yourdomain, a warning in Google Search Console's Security issues report, or a Safe Browsing warning. Any one of these means stop and investigate before doing anything else.

What is a good website speed score?

The score matters less than the three Core Web Vitals Google publishes thresholds for: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less, and Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of real visits. Test on mobile, not only desktop.

Is HTTPS enough to make my website secure?

No. HTTPS protects data travelling between the visitor and your site. It does nothing about outdated plugins, weak admin passwords, missing backups or a compromised hosting account, which is where most real problems start.

Are free security and speed tools reliable?

For an audit like this, yes. Google PageSpeed Insights, Google Search Console, the Safe Browsing site status page, SSL Labs and the Mozilla HTTP Observatory are free and widely used. They find problems; they do not fix them.

What does WPfoss website maintenance cost?

Plans are monthly with no lock-in: KES 5,000 for brochure sites, blogs and NGO sites, KES 10,000 for WooCommerce and M-Pesa sites, and KES 20,000 for custom applications and high-traffic sites. Every plan includes updates, daily malware scans, daily off-site backups, uptime monitoring and malware removal.