01Free check
Your site from the outside. As an attacker sees it.
A passive check of publicly visible information. No sign-in, no installation, no changes to your site. Result within two minutes.
Only check websites you own or are authorised to assess.
02What we check
Five areas. One score.
Each area carries its own weight. The sum gives a score from 0 to 100 and a grade from A to F.
Certificate validity, redirect to HTTPS, protocol version.
HSTS, CSP, clickjacking protection, software version disclosure.
Publicly reachable .env, .git, backups, debug logs, phpinfo, XML-RPC.
External scripts, obfuscation, hidden iframes, mixed content, redirects.
Known vulnerabilities in identified versions of WordPress core, plugins and themes.
03What this check cannot see
From the outside you only see the surface.
- File integrity
- We cannot see whether core and plugin files are original.
- Database
- We cannot see rogue administrators or injected code.
- Server configuration
- We cannot see file permissions, cron jobs or PHP settings.
- Malware
- A clean result does not mean a clean site. It only proves nothing is visible from the outside.
This free external scan only inspects publicly visible information. It cannot verify file integrity, database contents or server configuration and therefore cannot prove that a website is free of malware. A Deep Scan with server access is required for that.