Direct answer: A website security check is a review of observable conditions that may expose a website or its visitors to unnecessary risk. Depending on access and scope, it can examine HTTPS/TLS, security headers, exposed files, software configuration, forms, external resources, known vulnerabilities, and other indicators.
Remote checks versus internal audits
A remote check evaluates what can be observed from outside the server. An authenticated internal audit can inspect configuration, code, logs, file permissions, dependencies, user accounts, and infrastructure in much greater depth. These are different levels of assurance.
Common remote observations
Useful remote checks can include HTTPS availability, certificate conditions, HTTP security headers, mixed content, exposed sensitive paths, public directory behavior, insecure form actions, and visible technology or configuration disclosures. Some checks may be marked not tested when the necessary access is unavailable.
What a security check cannot guarantee
Passing a remote security check does not prove that a website is vulnerability-free. Undisclosed flaws, compromised credentials, server-level problems, application logic errors, and newly discovered vulnerabilities may not be observable during a particular test.
Use clear severity labels
Findings should distinguish pass, warning, critical, and not-tested conditions, with enough explanation for the owner to understand what was observed. Reports should state the time and scope of the test.
Security is an ongoing process
Security conditions change as software, credentials, integrations, hosting environments, and threat techniques change. Periodic checks, timely remediation, backups, access control, monitoring, and responsible administration work together.