How easy is your website to hack?

Paste your URL and get an instant security grade from A to F, with the three issues that matter most. Then fix them with clear, step-by-step instructions.

Works with WordPressShopifyWix and more
Passive scan. Nothing is attacked without your permission.
Sample report
sunnybakery.exampleScanned in 14s
Security grade
Fair — a few easy wins away from a B
High
Outdated WordPress plugin detected
A contact-form plugin is 3 versions behind a security release.
Medium
Missing Content-Security-Policy header
Browsers can't block injected scripts on your pages.
Medium
Login page reveals usernames
Author archives expose valid admin usernames.
9 more findings + fix instructionsUnlock full report
How it works

From URL to fixed in three steps.

No installs, no plugins, no jargon. Just a clear grade and a clear path to a better one.

01

Paste your URL

We run a passive, read-only check of what your site already shows the public. Nothing is touched.

https://yourwebsite.com
02

Get your grade

An A–F grade in seconds, with your top three issues ranked by real-world risk.

C 3 priority issues
03

Fix it, step by step

Verify you own the domain to unlock the full report, deeper tests and copy-paste fixes.

✓ Header added · re-scan
What we check

Eight layers of your site, one grade.

The free grade looks only at public signals. Deeper tests run only after you verify ownership and give explicit consent.

TLS & certificates

Protocol versions, cipher strength, expiry and HSTS.

Free scan

Security headers

CSP, frame options, referrer and permissions policies.

Free scan

WordPress core

Version exposure, XML-RPC, user enumeration, debug output.

Free scan

Exposed files

Backups, .env, .git folders and config files left public.

After verification

Known CVEs

Server software matched against published vulnerabilities.

After verification

Plugin vulnerabilities

Every installed plugin and theme checked for known flaws.

After verification

Payment pages

Checkout integrity, mixed content and third-party scripts.

After verification

Login security

Brute-force protection, 2FA hints and session cookie flags.

After verification
WordPress, first

Fixes written for your dashboard, not a textbook.

Most small-business sites run on WordPress, so that is where we go deepest. Every finding comes with instructions you can follow from wp-admin — or hand to your developer.

  • Plugin & theme audit. Each one matched to known vulnerabilities, with the safe version to update to.
  • Copy-paste fixes. Exact .htaccess, nginx or wp-config lines — no guesswork.
  • Re-scan to confirm. Watch the grade move as each fix lands.
Full report · Fix 2 of 12

MediumAdd a Content-Security-Policy header

Estimated time: 5 minutes · Apache / .htaccess
  1. Open .htaccess in your site's root folder.
  2. Paste the lines below at the very top and save.
  3. Click “Re-scan” to confirm the fix.
Copy# HackGrade fix · security headers
Header set Content-Security-Policy "default-src 'self'"
Header set X-Frame-Options "SAMEORIGIN"
Header set Referrer-Policy "strict-origin"
Pricing

Start free. Pay when you're ready to fix.

Simple plans in US dollars. Pay yearly and get 2 months free.

One-time report

A complete audit, once.
$29
One-time payment
  • Full report
  • All fixes, step by step
  • One deep scan
  • 30-day refund
Get the full report

Site

Ongoing protection for one site.
$12/ month
$120/ year
or $120 a year — 2 months free
Just $10 a month, billed yearly
  • 1 site
  • Weekly deep scan
  • Full report + alerts
  • All fixes, step by step
Start Site plan
Most popular

Pro

Deeper tests for online stores.
$29/ month
$290/ year
or $290 a year — 2 months free
About $24.17 a month, billed yearly
  • 1 site
  • Everything in Site
  • Test-account (logged-in) scanning
  • Cart & checkout logic tests
  • Card-theft / skimmer detection
Start Pro

Business

For owners with a few websites.
$49/ month
$490/ year
or $490 a year — 2 months free
About $40.83 a month, billed yearly
  • Up to 5 sites
  • All Pro features
  • Weekly scans on every site
  • Full report + alerts
Start Business

Agency

For studios managing client sites.
from$99/ month
from$990/ year
20 sites$99 / mo$990 / yr
50 sites$199 / mo$1,990 / yr
  • White-label PDF reports
  • Client dashboard
  • All Pro features on every site
Talk to us

Free check

$0
No credit card
  • A–F security grade
  • First 3 fixes, step by step
  • Monthly re-check for 1 site
Scan my site free
  • Yearly billing: 2 months free
  • 30-day full refund
  • Cancel anytime

Deep tests always require domain ownership verification and your explicit consent.  ·  Checked this week · HackGrade

For agencies

Security reports with your name on them.

Monitor 20 or 50 client sites from one place and send polished, white-label reports under your own brand — a new recurring service, without hiring a security team.

  • Your logo, your colors. Reports and emails carry your brand, not ours.
  • One dashboard. Every client's grade and trend at a glance.
  • Client-friendly language. Plain-language summaries owners actually read.
Your StudioClient overview · sample
SiteGradeLast scanStatus
northwind-dental.exampleAMon 09:12Verified — you control {host}.
olive-and-oak.exampleBMon 09:141 low issue
sunnybakery.exampleCMon 09:15Report ready
bluepeak-yoga.exampleAMon 09:17Verified — you control {host}.
harbor-legal.exampleDMon 09:18Needs attention
FAQ

Good questions.

All questions

Is the free scan safe for my site?+

Yes. It only reads what any visitor's browser already sees — headers, certificates, public pages. No attacks, no load.

Why do I need to verify my domain?+

Deeper tests probe your site more actively. We only run them for the verified owner, with explicit consent.

I'm not technical. Can I still fix things?+

That's the point. Each fix is written step by step, with copy-paste snippets and plain-language context.

Do you support sites that aren't WordPress?+

Yes. Every site gets a grade; WordPress sites also get plugin, theme and core-specific checks.

What do I get for free?+

An A–F grade, the full list of issues, step-by-step fixes for the first 3, and a monthly re-check for one site. Paid plans add every fix, weekly deep scans, alerts and more sites.

Can I cancel or get a refund?+

Yes. Cancel anytime. Every plan, including the one-time report ($29), comes with a 30-day full refund.

Free · Instant · No sign-up

Find out your grade before someone else does.

Passive scan. Nothing is attacked without your permission.