Small Business Security Self-Check (Free)

Enter your domain

A full web address, one starting with www., or just the domain all work, for example example.com.

The check runs in your own browser. It only looks up the public records of this domain and the email servers it points to through Cloudflare's public DNS (and Google's, if Cloudflare finds nothing) and never connects to your website. Whale doesn't receive what you type. Only check domains you own.

October 2026 security round-up

In October the US agency CISA added 34 flaws to its list of bugs confirmed to be used in real attacks. These are the five most relevant to a small business, plus two late-October incidents: Synology and Binance.

System	Who it affects	What can happen	What to do	Source
Synology NAS (DSM)	Anyone with a Synology NAS, especially one reachable from outside	Attackers break into older DSM versions, encrypt files as .L0CK3D and demand a ransom	Update DSM and affected packages, turn on automatic updates, close outside access	Synology statement, 29 Oct 2026, SA-24:20
PHP (PHP2Shell)	WordPress sites and most budget web hosting; some Synology packages	An attacker can take over the server without logging in	Ask your web host or developer to confirm PHP is updated	CISA, 26 Oct 2026, Synology SA-26:14
Windows	Every Windows computer	An attacker can get around a security protection over the network	Run Windows Update and restart	CISA, 13 Oct 2026
Plex Media Server	Anyone running Plex on a NAS or home server	Four flaws chained together can write files that then run	Update Plex and keep it off the internet	CISA, 20 Oct 2026
Adobe Commerce / Magento	Businesses with a Magento store	A dangerous file can be uploaded and run, giving control of the store or server	Ask your developer to apply Adobe's fix now	CISA, 27 Oct 2026
Ahsay backup (AhsayCBS)	Businesses using an Ahsay-based backup service	An attacker can skip the login and run system commands, putting backups within reach	Ask your backup provider whether they've updated; keep the admin page off the internet until then	CISA, 14 Oct 2026
Binance	Anyone holding crypto on Binance	A security incident paused some withdrawals; cause and losses not yet public	Turn on 2FA, follow only official announcements, don't click "compensation" or "refund" links	TechCrunch, 29 Oct 2026

Read the full round-up

Full list: CISA Known Exploited Vulnerabilities catalogue

Where small businesses usually get caught

Email. A phishing email steals your password, or someone poses as a supplier and says their bank details have changed.
Key accounts. Your domain, Google or Microsoft account, Instagram and Facebook pages, payment platform. Lose the domain or email account and your website and email can go down together. Lose a social page or payment account and customers and money go with it.
A NAS on the internet. Port forwarding on the router so you can reach files from outside means anyone can scan it.
Website admin. Outdated WordPress plugins and a weak admin password.
Shared passwords. Several people on one password, and accounts for people who've left still switched on.

Six things you can do this week

Turn on 2FA for email, your domain, banking, social pages and your NAS first. Use an authenticator app or a passkey, not just SMS. Save the backup codes somewhere safe so a broken phone doesn't lock you out.
Use a password manager, with a different password for every account.
Back up 3-2-1: three copies, on two kinds of storage, with one kept somewhere else. Ideally one copy is offline too. Unplug the external drive after each backup, because a drive left plugged in gets encrypted along with everything else.
Don't use port forwarding for your NAS. If you need it from outside, use a VPN.
Turn on automatic updates for systems and plugins.
If an email says a supplier's bank details have changed, call to check. Use the number you already have, not the one in the email.

Does changing the port help?

Not much. It stops some automated scans, but anyone actually looking will still find you. The real fix is keeping admin pages off the internet.

If you use a Synology NAS

Official sources: Synology statement (29 October 2026) and security advisory SA-24:20. If you have packages that use PHP, also read SA-26:14 (PHP2Shell).

Check first: open File Station and look for files ending in .L0CK3D, or a new file called read-me3.txt.

If you've been hit

Unplug the NAS network cable straight away, and any external drives attached to it.
Don't restart, update or delete anything (including read-me3.txt), and don't pay straight away.
Get help: call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) or report at cyber.gov.au.

If you haven't

Close every outside way in first: port forwarding and UPnP on the router, and QuickConnect in DSM. Leave the network cable in so the NAS can still download updates.
Update DSM to the latest version. Synology says attacks target outdated DSM, but a NAS could be compromised before you update, so don't reopen outside access straight away.
In Package Center, update each affected package you use: Synology Calendar, Mail Station and PHP. PHP 7.3 won't get a fix, so move to a newer PHP version.
If you still use the default admin account: first create another admin account and test that it logs in, check no sync or scheduled task relies on the old one, then disable it. Turn on 2FA for DSM logins, and turn on Auto Block.
Turn off packages and Docker containers you don't use.

Other free check tools

For what this page can't check, these tools help (only check your own website and accounts):

Leaked passwords: haveibeenpwned.com
Deeper email checks: mxtoolbox.com
SSL certificate and expiry: ssllabs.com/ssltest
Website security settings: Mozilla Observatory (a low score doesn't mean you've been hacked; usually a few advanced settings just aren't on)
Synology's built-in Security Advisor

Background: a Binance security incident and reports of Synology NAS .L0CK3D ransomware in late October 2026 (sources: TechCrunch, HKEPC and security media). Things are still developing, so go by official announcements.

Small business security self-check