Free tool
Free website security check
Enter your website and get a plain-English security report in under a minute: HTTPS, security headers, WordPress and plugin versions, and files that should not be public.
What the check looks at
Five areas, about 30 requests, all to public pages. Nothing is changed on your site.
HTTPS and certificate
- Site loads over HTTPS
- Certificate is valid and not close to expiring
- HTTP redirects to HTTPS
- HSTS tells browsers to always use HTTPS
Browser security headers
- Content-Security-Policy
- X-Frame-Options (clickjacking)
- X-Content-Type-Options
Server software
- PHP version against the php.net support dates
- Server and PHP version shown in public headers
- Software that no longer gets security fixes
WordPress core and plugins
- WordPress version against the current release
- Plugin versions against WordPress.org
- Plugins removed from WordPress.org
- Known vulnerabilities in your installed versions (Wordfence Intelligence)
- Premium or custom plugins with hidden versions
Exposed files
- XML-RPC is open
- Public user list (/wp-json/wp/v2/users)
- Browsable uploads folder
- /.git/ folder reachable from the web
A sample report
You get a letter grade, a score out of 100, and a short list of what to fix first. Each item says what we saw and what to do about it.
The example on the right is made up. Your report uses what your own site returns.
yourbusiness.com
WordPress 6.4 · PHP 8.1
PHP 8.1 no longer gets security fixes
FixThe server reports PHP 8.1. The php.net support window for that version has ended.
Fix: Ask your host to move the site to a supported PHP version, then test the site.
No Content-Security-Policy header
ReviewBrowsers get no instructions about which scripts may run on your pages.
Fix: Add a Content-Security-Policy header, starting in report-only mode.
HTTPS certificate is valid
PassedThe certificate is trusted and HTTP redirects to HTTPS.
What this check can’t tell you
- It looks from the outside only. It sees what any visitor or search engine can see.
- It is not a penetration test. Nobody logs in, guesses passwords or tries to break anything.
- It cannot see inside your server, your database, or your hosting account.
- It cannot detect malware that hides from visitors. Some infections only show to search engines or to logged-in admins.
- Plugin versions are read from public files. If a site hides them, the report says "Version hidden" instead of guessing.
Frequently asked questions
Is this scan safe to run on my site?
Yes. The check only reads public pages and files, the same way a browser does. It does not log in, submit forms or try to attack anything. A scan makes about 30 requests, which your site will treat like a few visitors.
What does the grade mean?
The grade summarizes the checks that failed or raised a warning. A is clean from the outside, B has minor gaps, C has several things worth fixing, and D or F means there are serious issues such as unsupported PHP, outdated WordPress, or exposed files. High-severity issues cost more points than low-severity ones.
Does it find malware?
No. This check looks at configuration and software versions from the outside. It cannot scan your files, and some malware hides from anonymous visitors. If you see spam pages in Google, strange redirects, or a browser warning, treat the site as possibly hacked and get it cleaned.
Why are my plugins "out of date"?
We compare the version your site publishes with the latest version listed on WordPress.org. If yours is lower, the plugin has an update waiting. Updates often include security fixes, which is why old versions matter. Premium and custom plugins are not on WordPress.org, so they show as "Premium or custom" and we cannot compare them. We also check each version we can see against the Wordfence Intelligence vulnerability database, refreshed daily, and link every known issue to its record.
Is my data stored?
We do not keep scan results. The report exists in your browser while you read it. If you ask us to fix the issues, what you send us (your name, email, and the list of issues from the report) comes to us by email.
Why does PHP version matter?
PHP runs your WordPress site on the server. Once a PHP version reaches end of life, it stops getting security patches, so new holes stay open. WordPress and plugins can also stop working on old versions.
Is WordPress secure?
WordPress core is maintained well. Most problems come from plugins and from sites that are not updated. Patchstack reports that 91% of new WordPress vulnerabilities in 2025 were in plugins (State of WordPress Security in 2026). Keeping plugins current and removing unused ones does most of the work.
Source for the plugin figure: Patchstack, State of WordPress Security in 2026.