Free · 30 seconds · no plugin needed
Is your website vulnerable?
Find out before a hacker does.
Small businesses with a WordPress or PHP site are mostly hit through an old plugin, a forgotten backup or an outdated PHP version. Often you only notice when Google flags your site as dangerous or customers start receiving spam.
We only do what any visitor can do: request pages. No attacks, no login attempts.
What we check
🔌 Outdated WordPress & plugins
Known vulnerabilities in Elementor, Contact Form 7, WooCommerce, Yoast, LiteSpeed Cache, Slider Revolution and more.📂 Exposed sensitive files
.env, wp-config backups, phpinfo pages, backup zips, an open .git folder.🐘 PHP & server
PHP versions without updates, servers revealing their version, insecure session cookies.🔒 HTTPS & headers
Does https work, is http redirected, are HSTS, CSP and the other protective headers set correctly.Free vs. full report
Free
- Risk score 0–100
- Number of critical, medium and low issues
- Which categories have problems
Full report
- Where each issue is (exact URL, plugin, version)
- What it means, in plain language
- A 3-step fix you or your web developer can follow
- Pro €19/month · one-time report €49
Questions
Can I scan any site I like?
Only your own site or a site you have permission for. That is why we ask you to confirm it. Our scan is passive: we request public pages, just like a browser.
Does a low score prove I have been hacked?
No. It means some doors are open. The more critical points, the easier it is for automated attack bots.
Do I need to install anything?
No. No plugin, no access to your hosting. You only enter your address.
Doesn't my web developer take care of this?
Maybe. With the full report you have it in black and white what needs to be done, and you can forward it.