NCSC Web Check has closed: how to check your practice website's security now

What happened to Web Check

Web Check was a free service from the National Cyber Security Centre that scanned public sector websites for common security problems. NHS England’s GP IT operating model still says ICBs will help practices get one. But the NCSC retired Web Check on 31 March 2026, and now suggests organisations use commercial attack surface management tools instead.

For most practices, buying a commercial scanning tool for one website isn’t worth it. Ask your ICB what it can offer instead, since the operating model expects it to help. Meanwhile, the free checks below cover the basics.

Five free checks

Run each one on your own website’s address. They only look at what any visitor can see, so they won’t affect your site.

1. Your padlock and certificate, with SSL Labs server test. Look for: A grade of A or A+. Anything lower usually means old encryption settings your supplier should update.
2. Security headers, with MDN HTTP Observatory. Look for: A grade of B or better. Headers like Content-Security-Policy and Strict-Transport-Security protect patients from fake content and hijacked connections.
3. Modern internet standards, with Internet.nl website test. Look for: Passes for HTTPS and security options. It's run by the Dutch Internet Standards Platform and works on any website.
4. Trackers and third-party scripts, with Blacklight, from The Markup. Look for: No ad trackers, no Meta Pixel and no session recording. See our guide to cookies and analytics for why.
5. A way to report problems, with Your own browser. Look for: A file at yourpractice.nhs.uk/.well-known/security.txt, which tells security researchers who to contact if they find a problem.

If any of these show a problem, send the result to your supplier and ask when it will be fixed. Most are settings on their side, not yours.

What to ask your supplier

The free tools only see the outside of your website. These questions cover the parts they can’t see:

1. Does signing in to our website need a code as well as a password? Without it, one stolen password lets someone change what patients read.
2. How quickly do you apply security updates? Look for days, not months, and updates that happen without you asking.
3. Can we see who changed what, and when? An audit log lets you check if something looks wrong.
4. How do you back up our site, and how fast can you restore it?
5. Will you tell us within a day if there’s a security incident affecting our site?

The NCSC’s small business guide is a good, short read on the rest of your practice’s cyber security.