5 boring things that quietly break small-business websites (and how to check each in two minutes)

Most small-business websites don't go down because of a clever attack. They go down because of something boring that nobody was watching: a certificate that expired on a Sunday, a domain renewal that failed because the card on file changed, or invoices that land in spam for months before anyone notices.

Here are the five I see most often, with a quick way to check each one yourself. Everything below uses public information only, so you can run it against any site you look after.

1. The TLS certificate expires

When the certificate expires, visitors get a full-page browser warning and most of them leave. Free certificates (Let's Encrypt and most hosting providers) last 90 days or less and depend on automatic renewal, which fails silently more often than you'd think: a DNS change, a moved server or a firewall rule is enough.

Check it:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate

Fix it: make sure automatic renewal is actually on for the domain you are serving (including www), and put the expiry date in a calendar two weeks early as a backup.

2. The domain itself expires

This one is worse than the certificate: when the domain lapses, the website and the email stop working, and in the worst case someone else registers it.

Check it with RDAP, the modern replacement for WHOIS:

curl -sL https://rdap.org/domain/example.com \
  | jq -r '.events[] | select(.eventAction=="expiration") | .eventDate'

Fix it: turn on auto-renew at the registrar, check that the payment card on file is current, and make sure the registrar's emails go to an address someone actually reads.

3. http:// doesn't redirect to https://

Many sites answer on both. People who type the address or follow an old link end up on the unencrypted version, and search engines may see two copies of every page.

Check it:

curl -sI http://example.com | head -n 5

You want a 301 or 308 status and a Location: header that starts with https://.

Fix it: most hosts have a "force HTTPS" switch. Once HTTPS works everywhere, add the Strict-Transport-Security header (HSTS) so browsers stop trying plain HTTP at all. Start with a short max-age and raise it once you're sure.

4. Email goes to spam: missing SPF or DMARC

If the domain has no SPF record, receiving mail servers can't tell which servers may send for it. Without DMARC, anyone can send mail that looks like it comes from your domain, and big providers increasingly send unauthenticated mail straight to spam.

Check it:

dig +short TXT example.com | grep spf1
dig +short TXT _dmarc.example.com

On Windows: nslookup -type=TXT example.com and nslookup -type=TXT _dmarc.example.com.

Fix it:

• Publish exactly one SPF record that lists every service that sends for you, for example v=spf1 include:_spf.google.com ~all for Google Workspace. Two SPF records break both of them.
• Start DMARC in monitoring mode: v=DMARC1; p=none; rua=mailto:[e-mail]. Read the reports for a few weeks, then move to p=quarantine.

5. The search basics are missing

A missing page title or description means search results show whatever text the search engine picks. A missing viewport tag makes the site look broken on phones. No robots.txt or sitemap.xml makes new pages slower to be found.

Check it: open the page source (Ctrl+U) and look for <title>, <meta name="description"> and <meta name="viewport">, then visit /robots.txt and /sitemap.xml.

Fix it: a title of 30 to 60 characters and a description of 50 to 160 characters that say what the business does and where. Most site builders have fields for both.

Bonus: security headers

While you are running curl -sI https://example.com, look for Strict-Transport-Security, X-Content-Type-Options: nosniff, a framing rule (X-Frame-Options or frame-ancestors in a Content-Security-Policy) and Referrer-Policy. None of them is hard to add, and together they block a whole class of cheap attacks.

Or check all of it at once

I got tired of running these by hand for every site, so I built a free checker that does all of the above (19 checks) in about 20 seconds: guides.webcareshelf.com/check. You get a score and the top three problems with no signup, and it doesn't save results.

Disclosure: it's my project. There is an optional $9 full report with every check and a plain-English fix for each problem, and the same key works again after you make the fixes. The commands above give you the same information for free.

If you find a false positive or a check you think is missing, tell me in the comments.