TLS certificate
Is the certificate trusted, and when does it expire? An expired certificate puts a full-screen warning in front of every visitor.
Free website security check
Most WordPress and PHP sites get breached through problems you can spot from the outside: outdated software, weak HTTPS, missing protections. Find out in under a minute. Nothing to install, and nothing on your site changes.
Connecting…
This free check doesn't look for downloadable backups, database dumps, .env files or debug logs,
and it can't see the PHP version, plugins and configuration running on your server. Those are where the serious breaches start.
What the free scan checks
Is the certificate trusted, and when does it expire? An expired certificate puts a full-screen warning in front of every visitor.
Do plain http:// visits get redirected to HTTPS, and does HSTS stop browsers from downgrading later?
Content-Security-Policy, clickjacking protection, MIME sniffing and referrer policy: the browser-side defences most sites forget.
Server banners and X-Powered-By headers that tell attackers exactly which exploits to try.
The WordPress version and the plugins we can see, checked against known vulnerabilities and the latest releases.
If your site reveals its PHP version, we check it against every published PHP CVE and its end-of-life date.
Deep scan
Breaches usually come from what you can't see from the home page. In a deep scan, our team checks your site and server with your written permission and sends you a PDF report: every issue, its risk, and the exact fix.
| Free | Deep | |
|---|---|---|
| HTTPS, certificate & security headers | ✓ | ✓ |
| WordPress & visible plugin vulnerabilities | ✓ | ✓ |
Exposed backups, SQL dumps, .env, .git, debug logs | – | ✓ |
| The PHP version that actually runs your site, against every PHP CVE | – | ✓ |
| All plugins & themes, including hidden ones | – | ✓ |
php.ini, file permissions, databases open to the internet | – | ✓ |
| Signs of webshells and past compromise | – | ✓ |
| PDF report with prioritised fixes & a walkthrough call | – | ✓ |
How a deep scan works
Use the form below. We reply within one business day.
You confirm in writing that we may test the site, and agree a time window.
Every check only reads. We never modify files, submit forms or copy your secrets into reports.
A prioritised PDF report, and a call to go through the fixes with your team.
Contact us
Tell us which site you'd like checked. We'll confirm the scope with you before we send a single request.
Why we ask for authorization: a deep scan requests files that shouldn't be public, such as backups and config copies, to prove whether they are. Doing that to a site without the owner's permission isn't something we'll do, so we need your go-ahead first.
Yes. It loads your home page over HTTPS and HTTP, the same as a visitor's browser would, and reads the response. It sends no attack payloads, doesn't log in, and doesn't submit forms.
So only people from the organisation that runs a site can scan it. Use a company address at the site's domain: for shop.example.com, any @example.com address works. Personal or disposable inboxes (Gmail, Yahoo, Hotmail, Outlook.com, Yopmail and similar) are refused. We then email a one-time code to that address before the scan runs.
We send a verification code, keep a record of which sites were scanned and by whom, and we may follow up once about your results. We don't sell or share it.
A good grade means the outside basics are in place. The most damaging problems, like a backup with your database password in a public folder or an unpatched PHP version, are only visible with a deep scan.
No. The HTTPS, certificate, header and version checks work for any website. The WordPress and PHP checks add detail when they apply.