Free website security check

Is your website secure? Find out in seconds.

Paste your address and get an A–F security grade with the issues that matter most, ranked by real-world risk. Passive and read-only: we look at what any visitor’s browser already sees.

Passive scan. Nothing is attacked without your permission.

What the free check looks at

  • HTTPS and certificates: HTTP to HTTPS redirect, certificate trust and expiry, TLS version, HSTS.
  • Security headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
  • Cookies and software: missing Secure/HttpOnly/SameSite flags, server and PHP versions on show, outdated JavaScript libraries, mixed content.
  • WordPress: public core version, known vulnerabilities in core, plugins and themes, outdated components, listed usernames, XML-RPC.
  • Email spoofing: SPF and DMARC records for your domain, plus a security.txt file.

What you get back

  • An A–F grade and a 0–100 score you can re-check after every fix.
  • Every issue in plain language, ranked from critical to informational.
  • Step-by-step fixes for your first 3 issues, free. Copy-paste lines for nginx, Apache (.htaccess), Cloudflare and WordPress.
  • A monthly re-check for one site when you create a free account.

Deeper tests, only with your permission

Once you verify that you own the domain (a DNS record, a file or a meta tag) and give explicit consent, paid plans run deeper tests:

  • Exposed .env, .git, backups, database dumps, phpinfo and debug logs.
  • TLS protocols and ciphers, open ports, directory listing, admin panels.
  • Injection tests (SQLi, XSS, SSTI, open redirect), CORS, CSRF and JWT issues.
  • For stores: cart and checkout price tampering, coupon abuse, card-testing exposure and skimmer signals (unknown or changed checkout scripts, fake payment forms, lookalike domains).
  • Injected code such as fake CAPTCHA / ClickFix pages and blockchain-loaded scripts.

What no remote scanner can see

A remote scan sees what the internet sees: your pages, headers, certificates and DNS. It can’t read your server’s files, your database or your hosting panel, so a clean grade is a strong signal, not a guarantee. We say exactly what we checked and what we didn’t, and the deeper tests only run after you prove you own the site.

Frequently asked questions

Is the free website security check safe to run?

Yes. It only makes the same kind of requests a normal visitor’s browser makes: pages, headers, certificates and public DNS records. Nothing is attacked and no load is added.

How is the grade calculated?

Each finding has a severity. Critical and high issues, such as no HTTPS or a plugin with a known vulnerability, pull the score down far more than missing best-practice headers. The letter grade comes from the score.

Do I need to install anything?

No. There is no plugin and no code to add for the free check. You only add a DNS record, file or meta tag if you want the deeper, consent-based tests.

Does it work for sites that aren’t WordPress?

Yes. Every site gets the HTTPS, header, cookie, software and email checks. WordPress sites also get core, plugin, theme and user checks.

Guides with copy-paste fixes

Guide

Security headers

Copy-paste HTTP security headers for nginx, Apache (.htaccess), Cloudflare and WordPress: HSTS, X-Content-Type-Options, frame protection, Referrer-Policy and Permissions-Policy.

Guide

HSTS

What HSTS does, why a short max-age first, when to use includeSubDomains and preload, with copy-paste lines for nginx, Apache and Cloudflare.

Guide

HTTPS & mixed content

Force HTTPS with a single 301 redirect, fix mixed-content warnings, avoid Cloudflare redirect loops and update old http:// links in WordPress with WP-CLI.

Guide

SPF, DKIM & DMARC

Stop scammers sending email as your domain. Copy-paste SPF and DMARC records for Google Workspace and Microsoft 365, plus a safe path from p=none to p=reject.

Guide

Check your website security

A free, safe way to check your website security: HTTPS, security headers, email records, WordPress updates and exposed files, with the exact commands and what good results look like.

Guide

Security grades A–F explained

How HackGrade’s A–F website security grade is calculated: points per issue severity, per-category caps, and the rules that cap a grade when there is a critical or high-risk issue.

Guide

Small-business security checklist

A practical website security checklist for small businesses: HTTPS, updates, backups, two-factor login, security headers, email records, domain safety and monitoring, with links to step-by-step fixes.

More free checks

Free · Instant · No sign-up

Find out your grade before someone else does.

Passive scan. Nothing is attacked without your permission.

Free to start. Paid plans from $12 a month, or a one-time report for $29. See pricing