Why this is the manager’s business, not just the developer’s

The website was often built a few years ago, the agency that built it now works with others, and the logins are “somewhere”. Yet three things depend on it, and the manager is responsible for all three:

  • Clients’ trust. A hacked website can spread scam pages, and Google then shows a red warning instead of your company.
  • Email. The same domain is also your email address. If it isn’t protected, Sigitas the scammer (our recurring villain — Sigitas is a common Lithuanian first name) can write to your clients “as you” — as in the lesson Invoice fraud.
  • The domain itself. A forgotten renewal means that the next day your website and email may be gone.

The good news: you can check all of it in 15 minutes with free public tools.

The most important rule: you only check your own

All the tools in this lesson only look at what the website shows everyone. They don’t break into anything. But deeper scanning without the owner’s permission may be illegal.

So we check only our own website — or one whose owner has given permission. We write this rule into the AI prompt too.

Four tools, four questions

  1. SSL Labs — is HTTPS set up properly, and when does the certificate expire? The goal is a grade of A or better.
  2. Mozilla Observatory — does the website send the browser security instructions (security headers)?
  3. internet.nl — the website and email in one go: is the domain protected against spoofing (SPF, DKIM, DMARC)?
  4. Google Safe Browsing — does Google consider your website dangerous?

On top of that, two questions that you answer, not a tool: who has access to the website and when the domain registration expires.

What the result looks like

Here’s an example of the report you should get after the check:

Example: a 15-minute check

🌐 yourcompany.lt · sample report
HTTPSSSL Labs: A, certificate valid✓
GoogleSafe Browsing: no threats found✓
HeadersObservatory: security headers missing✗
Softwarecontent management system no longer updated✗
Emailno DMARC record✗
Domainauto-renewal switched off✗

Not “bad” or “good”, but four clear tasks — each with a person responsible.

The most common picture: HTTPS is already fine, while email protection and updates aren't.

The 15-minute check — done by AI

If your AI can control a browser, it will open all four tools itself, enter your domain and collect the results. If it can’t, it will tell you where to click, and you’ll paste the results in. Copy and paste:

You are my IT security adviser. Check my company website's security with
public tools and prepare a report that someone outside IT would understand.

ABOUT US
- Website: [yourcompany.lt]
- Who built and maintains it: [agency / employee / don't know]
- Where it's hosted, if you know: [...]

PROCESS
0. TOOLS. Tell me whether you can control a browser yourself. If not, give me
   the links and tell me what to paste back to you.
1. CHECK. SSL Labs, Mozilla Observatory, internet.nl (website and email),
   Google Safe Browsing. Only my domain.
2. ASK. Ask me who has access to the website and whether domain
   auto-renewal is switched on.
3. REPORT. As a table: what was checked → result → what it means in plain
   words → who should fix it. Rank the problems by risk.
4. TASKS. For each problem, write a short, precise message I can forward
   to the website developer or the hosting company.

GOAL
The job is finished when I have a one-page report and ready-made messages
for each person responsible.

RULES
- Check only the domain I gave you. No deeper scanning.
- Change nothing: not on the website, not in DNS, not in hosting.
- Never ask for passwords or access to the admin panel.
- Don't make up results. If a tool didn't respond, say so.
- Answer in English.

AT THE END
Separately — WHAT YOU DID NOT CHECK (e.g. admin accounts, backups,
the inside of plugins), and what to ask the website developer.

🤖 AI route recommended

The AI checks, you decide

An AI that controls a browser will run all four checks itself and return a report with ready-made messages. An ordinary AI chat will ask you to paste the results in — still faster than working out each grade yourself.

Your job: answer two questions about access and the domain, and forward the messages to the people responsible.

✋ Manual route

Four tabs

  1. Open the four tools above and enter your domain in each.
  2. Write down the grades and the items marked in red.
  3. Send the screenshots to your website developer with the question “which of these will you fix, and by when?”.

Email protection: three records that are most often missing

This point matters most, because scammers exploit it directly. The domain’s DNS settings must contain three records:

  • SPF — a list of the servers allowed to send in your domain’s name.
  • DKIM — an electronic signature on every email you send.
  • DMARC — an instruction to recipients on what to do with an email that pretends to be you.

DMARC is brought in gradually: at first in monitoring mode only, so that your genuine emails (e.g. from your invoicing software) aren’t stopped, and only then is it tightened. That’s a job for an IT person or your email provider — but you can check yourself, in a minute, whether it’s been done.

What to do today

  1. Copy the prompt and get your report in 15 minutes.
  2. Check the domain’s expiry date and switch on auto-renewal.
  3. Forward the ready-made messages to the people responsible, and put the next check in the calendar for three months from now.

Need help? pagalba@itbroliai.lt

Check yourself

Five questions on what you’ve just read. At the end you’ll get a certificate with your score.