Keep card skimmers out of your checkout.
Online stores are targeted for one reason: payment data. Start with a free passive scan of your store, then let the deep tests check the checkout itself.
Free scan for your store
- Outdated or vulnerable WooCommerce, WordPress, plugins and themes.
- HTTPS, HSTS and mixed content on your pages.
- Content-Security-Policy, which limits where scripts can load from and send data to.
- Outdated JavaScript libraries and cookie flags.
Deep store tests (Pro plan, verified owners)
- Skimmer signals: unknown or changed checkout scripts, inline code sending data out, fake payment forms, lookalike domains and missing CSP/SRI on checkout.
- Cart and checkout logic: price and quantity tampering and coupon abuse.
- Card testing: whether your checkout can be abused to try stolen cards in bulk.
- WooCommerce REST API exposure and logged-in tests with a test account.
Why this matters for PCI DSS
PCI DSS v4.0 added requirements for payment pages: keep an inventory of the scripts that run on them and authorise each one (6.4.3), and detect unauthorised changes to their scripts and headers (11.6.1). HackGrade isn’t a QSA and doesn’t certify compliance, but the checkout tests give you evidence and early warning. See the PCI SSC document library.
Frequently asked questions
Can a scan find a skimmer on my WooCommerce site?
The free passive scan finds the weaknesses skimmers use to get in. The Pro deep scan, after you verify ownership, looks at checkout scripts for skimmer signals and changes.
Will the checkout tests place real orders?
No. The tests are designed for verified owners and run only with explicit consent. Read the scan authorization agreement for exactly what runs.
Do I still need a security plugin?
A plugin protects from inside WordPress; an outside scan checks what attackers and customers actually see. They complement each other.
Guides with copy-paste fixes
Checkout skimmers
How card skimmers get into online stores, and how to stop them: script inventory, CSP on checkout, SRI, hosted payment fields and change detection (PCI DSS 4.0 6.4.3 and 11.6.1).
GuideWordPress hardening
A practical WordPress hardening checklist with copy-paste snippets: block XML-RPC, hide usernames, disable the file editor, protect wp-config.php and stop PHP in uploads.
GuideContent-Security-Policy
Roll out a Content-Security-Policy without breaking your site: start in report-only mode, build an allow-list, then enforce. Examples for nginx, Apache and WordPress.
More free checks
Find out your grade before someone else does.
Free to start. Paid plans from $12 a month, or a one-time report for $29. See pricing
This page is in English. Translations are on the way.