HTTPS and TLS transport
Certificate validity and expiry, whether plain HTTP redirects to HTTPS, and whether HSTS is declared. An expired certificate is the outage nobody has a monitor for.
What your site tells an attacker before they try anything
A passive review of the security posture your site advertises publicly: TLS and HTTPS transport, defensive response headers, exposed configuration, and known WordPress advisories.
Passive external automated assessment only. Unavailable checks stay neutral. This is not a penetration test or a guarantee of security.
Free
No signup
Non-intrusive
What the scan inspects
Everything here is visible to anyone who visits your site. We just read it carefully.
Defensive response headers
Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and friends. These are the cheapest hardening available and they are usually simply absent.
Exposed configuration
Publicly reachable files that should not be — environment files, version-control directories, backups and debug endpoints left on after a deploy.
WordPress vulnerability intelligence
Where a WordPress version or plugin is publicly identifiable, we match it against high-confidence advisory data and flag anything on the known-exploited list.
Information leakage
Server and framework versions announced in headers, verbose error output, and other details that narrow an attacker's search for free.
Threat reputation, on request
A separate, consent-gated lookup of whether your domain is currently flagged by threat-intelligence providers. The verdict is never stored in the retained report.
Why the passive surface matters
Most sites are not compromised by a bespoke attack. They are found by an automated scan looking for exactly these signals.
Attackers scan first, choose second
Mass scanning for exposed config files and known-vulnerable plugin versions is continuous and cheap. Not advertising a target is most of the defence.
Headers are a one-line fix
Most defensive headers are a few lines of server or framework configuration. They are missing on the majority of sites purely because nobody checked.
Certificates expire on a Saturday
An expired certificate blocks every visitor with a full-page browser warning. Knowing the expiry date before your customers do is worth the scan on its own.
How the scan works
Requests a visitor could make, read more carefully than a visitor would.
-
We fetch your site as a visitor
Ordinary HTTPS requests to public URLs. No payloads, no fuzzing, no attempt to exploit anything we find.
-
Signals are graded by confidence
Findings are weighted by severity and by how certain the evidence is, so a confident critical counts and a low-confidence guess does not dominate your score.
-
Unavailable checks stay visible
If a check could not run, it is shown as unavailable rather than silently passing. A gap in coverage is reported as a gap, not as a clean result.
Security questions
What this is, what it is emphatically not, and how the score is built.
Is this a penetration test?
No, and it is important not to treat it as one. This is a passive external assessment: we make ordinary requests to public URLs and read what comes back. Nothing is exploited, no payloads are sent, no authentication is attempted. A penetration test is an authorised, manual, intrusive engagement by a human, and nothing here substitutes for one.
Is it safe to run against a production site?
Yes. The scan does no more than a handful of normal page requests would. It does not attempt logins, submit forms, or send anything a visitor could not send. You will see it in your access logs as ordinary traffic.
How is the security score calculated?
It starts at 100 and deducts for findings by severity, scaled by how confident the evidence is. Each category — transport, headers, exposure, software advisories, threat reputation — has a cap on how much it can deduct, so one noisy area cannot drag the whole score to zero on its own.
Can I scan a site I do not own?
Technically the checks are passive and equivalent to visiting the site, but scan sites you are responsible for. Reports contain findings about a real system and are yours to handle appropriately, and the terms of service are the binding word on acceptable use.
Why does it say a check was unavailable?
Some checks depend on external intelligence feeds or on signals your site may not expose. When one cannot run, we mark it unavailable and leave it neutral rather than counting it as a pass. Treating an unknown as a clean result is how scanners produce false confidence.
It found nothing. Am I secure?
You are not advertising the problems this scan can see from the outside, which is genuinely worth having. It says nothing about application logic, access control, dependency vulnerabilities in code we cannot see, or anything behind a login. Treat a clean result as a cleared baseline, not a verdict.
Check the rest of your site health
Security posture is one of five checks. Each runs on its own, or all of them together in one score.
Accessibility
Find the barriers that turn visitors away, and the compliance gaps that carry legal risk.
Speed
Slow pages lose sales and rankings. See exactly which pages drag, on mobile and desktop.
Broken Links
Dead ends frustrate visitors and quietly drain SEO. We crawl every page and flag every 404.
AI-Readiness
Check whether ChatGPT, Perplexity and Google AI Overviews can reach, read and quote your content.
Monitoring
Know your site is down before your users tell you, and watch its health score over time.
Full Site Check
Run every check in one pass and get a single health score with the top three things to fix.