Website security, fixed step by step.
Short, practical guides with lines you can paste into nginx, Apache, Cloudflare or WordPress. Every guide links to its sources.
All guides
Security headers
Copy-paste HTTP security headers for nginx, Apache (.htaccess), Cloudflare and WordPress: HSTS, X-Content-Type-Options, frame protection, Referrer-Policy and Permissions-Policy.
GuideContent-Security-Policy
Roll out a Content-Security-Policy without breaking your site: start in report-only mode, build an allow-list, then enforce. Examples for nginx, Apache and WordPress.
GuideHSTS
What HSTS does, why a short max-age first, when to use includeSubDomains and preload, with copy-paste lines for nginx, Apache and Cloudflare.
GuideIs WordPress hacked?
The signs of a hacked WordPress site, how to confirm it with WP-CLI checksums, and a clean-up checklist: users, files, salts, updates and a Google review.
GuideWordPress hardening
A practical WordPress hardening checklist with copy-paste snippets: block XML-RPC, hide usernames, disable the file editor, protect wp-config.php and stop PHP in uploads.
GuideHTTPS & mixed content
Force HTTPS with a single 301 redirect, fix mixed-content warnings, avoid Cloudflare redirect loops and update old http:// links in WordPress with WP-CLI.
GuideCheckout skimmers
How card skimmers get into online stores, and how to stop them: script inventory, CSP on checkout, SRI, hosted payment fields and change detection (PCI DSS 4.0 6.4.3 and 11.6.1).
GuideExposed .git, .env & backups
Leaked .env files, .git folders and database backups hand attackers your passwords. Check if yours are public, block them on nginx or Apache, and rotate the secrets.
GuideSPF, DKIM & DMARC
Stop scammers sending email as your domain. Copy-paste SPF and DMARC records for Google Workspace and Microsoft 365, plus a safe path from p=none to p=reject.
GuideCheck your website security
A free, safe way to check your website security: HTTPS, security headers, email records, WordPress updates and exposed files, with the exact commands and what good results look like.
GuideSecurity grades A–F explained
How HackGrade’s A–F website security grade is calculated: points per issue severity, per-category caps, and the rules that cap a grade when there is a critical or high-risk issue.
GuideCheck your SSL certificate
Check your SSL/TLS setup in six steps: trusted chain, matching names, expiry and auto-renewal, TLS 1.2/1.3 only, HTTP to HTTPS redirect and HSTS. Commands and config for nginx and Apache.
GuideOutdated WordPress plugins
Find outdated and vulnerable WordPress plugins and themes: the Updates screen, WP-CLI commands, public vulnerability databases, closed plugins and safe auto-updates.
GuideSmall-business security checklist
A practical website security checklist for small businesses: HTTPS, updates, backups, two-factor login, security headers, email records, domain safety and monitoring, with links to step-by-step fixes.
GuideCookie security flags
What the Secure, HttpOnly and SameSite cookie flags do and how to set them in PHP, WordPress, nginx and Apache, without breaking cookies your scripts need.
GuideHide server and PHP versions
Stop advertising your software versions: server_tokens in nginx, ServerTokens in Apache, expose_php in PHP and the WordPress generator tag, plus why updating matters more than hiding.
GuideAdd a security.txt file
Publish a security.txt file so researchers can report problems to you: required fields, an example, where to put it on nginx, Apache and WordPress, and how to keep it valid.
GuideScanner vs pentest vs header checker
A fair comparison of free security header checkers, automated website security scanners such as HackGrade, and manual penetration tests: what each finds, what it misses, and when you need which.
Free checks
Find out your grade before someone else does.
Free to start. Pro from $29 a month (about $24 billed yearly), or a one-time full report for $29. See pricing