Why is web security important, and how do you audit a website?

16 October 2026 · By John Carlsson

Web security is important because a weak site exposes visitors to tampering and eavesdropping, and exposes the owner to Google warnings such as "This site may be hacked" and browser warning pages. Audit a website by scanning its headers and redirects with MDN HTTP Observatory, checking Search Console's Security Issues report, then testing deeper with the OWASP Web Security Testing Guide.

Why does web security matter to your visitors?

Every visitor trusts that the page they load is the page you published. Google's web.dev guide to HTTPS explains what can happen without that protection. Unprotected traffic can be altered on the way, for example by attackers or by parties that inject adverts into pages. Images, cookies, scripts and HTML can all be exploited, and interception can happen on a device, on a Wi-Fi hotspot or at a compromised internet provider.

Privacy is the other half. HTTPS stops eavesdroppers from passively listening to traffic. Even ordinary browsing can reveal a lot, because observers can look at aggregate browsing activity to make inferences about a person's behaviour and intentions. Modern browser features also depend on HTTPS, including camera and microphone access through getUserMedia(), service workers for offline use and progressive web apps.

What happens to your site if it gets hacked?

A security problem also damages the owner. Google's help page on security warnings lists labels such as "This site may be hacked" and "This site may harm your computer" that can appear next to affected results. Chrome's Safe Browsing can show a warning page before people reach affected pages, whether they arrive from search or from another link. Google can also hide pages from results.

Verified Search Console owners may receive an email, and details appear in the Security Issues and Manual Actions reports. The fix is to clean and secure the site, then request a review only once the problem is solved. Google says malware reviews take a few days, while reviews for hacked spam can take several weeks.

How do you do a security audit of a website?

Work from quick automated checks towards a structured, deeper test:

Scan the site with MDN HTTP Observatory. It checks HTTP response headers and redirect behaviour on any public site and gives a grade.
Check that the first redirect goes from HTTP to HTTPS on the same hostname. MDN gives http://example.com to https://example.com to https://www.example.com as correct, because it lets Strict-Transport-Security apply.
Review the Security Issues report in Search Console for anything Google has already detected.
Check the areas the scanner does not cover: outdated software, vulnerable CMS plugins, SQL injection and how passwords are created and stored.
For a full assessment, follow the OWASP Web Security Testing Guide. It is a framework of best practices used by penetration testers and organisations worldwide, and version 4.2 is the latest numbered release. OWASP suggests citing tests with versioned identifiers, such as WSTG-v41-INFO-02.

The Observatory FAQ is clear that a high grade does not mean a site is secure. It means the site has the defensive headers the tool checks for. The issues it does not test are just as important.

Which security headers should you check?

The MDN launch post lists what the Observatory looks at:

Content-Security-Policy, which controls where a page can load resources from.
Strict-Transport-Security, which keeps connections on HTTPS.
X-Content-Type-Options, which enforces correct MIME types.
X-Frame-Options or the CSP frame-ancestors directive, which limit framing to help prevent clickjacking.
Referrer-Policy, cookie settings, CORS, Subresource Integrity and Cross-Origin-Resource-Policy.

As a reference point, MDN recommends this configuration for API endpoints, while noting that the Observatory is designed for websites:

Content-Security-Policy: default-src 'none'; frame-ancestors 'none'
Strict-Transport-Security: max-age=63072000
X-Content-Type-Options: nosniff

A normal web page needs a policy that fits the scripts, styles and images it actually loads, so build and test your own rather than copying another site's. The AI Web Page SEO Security Audit checks these headers and related basics on any public page.

Sources

Frequently asked questions

Does a good HTTP Observatory grade mean my site is secure?

No. MDN says a high grade only means the site has the defensive HTTP measures the Observatory checks for, such as security headers and a correct HTTPS redirect. It does not test outdated software, SQL injection, vulnerable CMS plugins or how passwords are stored, and the current version does not analyse TLS certificates. Those areas need separate checks, for example by following the OWASP Web Security Testing Guide.

How long does it take Google to remove a hacked site warning?

Google says you should request a review in the Search Console Security Issues report only after the site is fully cleaned. Reviews for malware usually take a few days, while reviews for hacked spam can take several weeks. Once a review succeeds, search warnings may take a few days to clear, and browser warnings can lag behind by a day or two.