--- title: "What a Free Website Check Finds on Small NH Websites | T10" url: "https://t10.net/blog/free-website-check-small-nh-websites/" description: "Six things a read only website check turns up again and again on older small business and nonprofit sites in New Hampshire, who to ask to fix each, and one…" lastmod: "2026-10-08" --- ![](https://t10.net/media/blog/gen-free-website-check-small-nh-websites-hero-d5d167.webp) [Back to Insights](https://t10.net/blog/) # What a Free Website Check Finds on Small NH Websites T10 Consulting October 8, 2026 5 min read A lot of New Hampshire small business and nonprofit websites were built five or eight years ago by a nephew, a freelancer, or a local agency that has since moved on. They still load, the phone number is right, and nobody has opened the back end since. That is the situation a free website check is meant for. The check reads only what is publicly visible to anyone on the internet. It never tries to log in, guess a password, or probe the site for weaknesses. It looks at the same things a browser, an email server or a scammer's scanning tool can already see. A 68-second concept film: how attackers find sites like this one, and what the free check and the fixes change. The inn and its website are made up. Sources for each claim appear on screen. Here is what turns up most often. ## 1\. An out-of-date WordPress install Many small sites run on WordPress, and WordPress itself, its themes and its plugins all need updates. A site that hasn't been updated in years can carry known security holes that are publicly documented. **Why it matters:** an old install is the easiest kind to break into, and a hacked site can send visitors to junk pages or get flagged by search engines. **Who to ask:** whoever built the site or your hosting company. Ask whether updates are being applied, by whom, and whether there is a backup first. ## 2\. A login page open to the whole internet A standard WordPress login page sits at a predictable address, and anyone can load it. That alone isn't a break-in, but automated tools try passwords against those pages all day. **Why it matters:** a weak or reused password on an open login page is an invitation. **Who to ask:** your web designer or host, about limiting login attempts, adding two-step sign-in, and removing accounts for people who no longer work with you. Former staff and former contractors with live accounts are common. ## 3\. No SPF or DMARC record These are short entries in your domain's settings that tell the world which servers are allowed to send email as you. Without them, someone can send a message that appears to come from your address, and receiving servers have little to check it against. **Why it matters:** a fake invoice or a fake request to a board member that looks like it came from your executive director is a cheap trick, and this makes it easier. It also affects whether your own real email lands in spam. **Who to ask:** whoever manages your domain and your email (your email provider or the person who set up your domain). We wrote about a related kind of fraud in [the voice-clone call asking for a wire transfer](https://t10.net/blog/voice-clone-wire-transfer-nh-small-business/). ## 4\. A security certificate close to expiring The certificate is what lets a browser show a padlock and load your site securely. Many renew automatically, but some were set up by hand and quietly stop renewing. **Why it matters:** when it expires, visitors see a full-page browser warning that the site is not safe, and most will leave. **Who to ask:** your host or designer. Ask whether renewal is automatic and who gets the notice if it fails. ## 5\. A site that doesn't send visitors to https If someone types your address without the secure prefix, the site should send them to the secure version. Some older sites don't, so the same page can be reached in a secure and an insecure form. **Why it matters:** browsers label the insecure version as not secure, and a contact or donation form on it is exposed. **Who to ask:** your host or designer, who can add a redirect. It is usually a small change. ## 6\. A domain about to lapse, or held in someone else's name The domain registration is the one item on this list that can take everything else away. If it expires, your website and your email addresses can stop working. If it is registered in a former web designer's name, with their email address on the account, you may not be able to renew or move it when you need to. **Why it matters:** getting a domain back from someone who has stopped answering is slow and sometimes impossible. **Who to ask:** the registrar listed in the public registration record, and then the designer, if the name on it isn't yours. The goal is for the registration to be in your organization's name, with an email address you control. Finding Who to ask first Old WordPress Designer or host Open login page Designer or host No SPF or DMARC Email or domain provider Certificate near expiry Host or designer No https redirect Host or designer Domain expiring or not yours Registrar, then you ![Six cards listing the common website findings, each paired with the person to ask to fix it.](https://t10.net/media/blog/gen-free-website-check-small-nh-websites-infographic-d4cb5f.webp) ## What the check can't do, and who decides The check reports what it sees and explains it in plain language. It does not change anything on your site, and it can't tell you whether an old plugin is in use for something your business depends on. A person who knows the site has to decide what gets updated and when. Take a nonprofit with a donation page. Before anyone updates the software behind it, someone should confirm there is a recent backup and that the page still works afterward. That decision belongs to you and your web person, not to a report. The free check is offered on our [nonprofits page](https://t10.net/nonprofits/). Any small business can learn from the results, since these six findings show up on shops, inns, contractors and offices as often as on nonprofits. If you want help thinking through the fixes, our [team training](https://t10.net/services/ai-cowork-training/) covers how to read this kind of report and what to ask your vendors. ## A first step this week Find out who owns your domain registration and when it expires. Look up your domain in a public registration lookup, or ask your web designer, and write down three things: the registrar, the name on the account, and the expiration date. Put the expiration date on the calendar with a reminder a couple of months ahead. If the account is in someone else's name, ask now to have it moved into yours while that person is still easy to reach. If you'd like us to look at the rest with you, [book a planning call](https://t10.net/#book). It's 30 minutes and free. [Back to Insights](https://t10.net/blog/) ## About this post Author T10 Consulting Published Oct 8, 2026 Reading time 5 min ## Tags - new hampshire - website security - small business - nonprofits - email security ## Related posts - [Christmas Tree Farms: Answering the Same Questions in Five Weekends](https://t10.net/blog/christmas-tree-farm-weekend-questions-ai-nh/)Oct 14, 2026 - [When the Water Test Comes Back: AI for NH Well Companies](https://t10.net/blog/water-test-results-letters-nh-well-companies-ai/)Oct 12, 2026 - [Map One Job Before You Buy Any AI Tool](https://t10.net/blog/map-one-workflow-before-buying-ai-tool/)Oct 10, 2026 ## Want to see where AI fits in your week? A free 30-minute planning call. Tell us how the week runs, and we'll say plainly which parts AI is good at and which it isn't. [Book a planning call](https://t10.net/#book)[More insights](https://t10.net/blog/)