Known flaws in your software
WordPress, plugins, themes and server software, checked against public flaw lists and the US list of flaws used in real attacks.
Is your website an easy target?
Get a free security grade in about 30 seconds. We show the worst problem in plain words, and how to fix it.
Example result
DPoor
An add-on on your website has a serious known flaw.
- A stranger could use it without a password
- Anyone can send email that looks like it came from you
- Every page opens securely
Each problem comes with how to fix it.
What we check
Only what any visitor or public record can see.
Google’s danger list
Whether Google warns people away from your website.
Hidden spam and hijacked code
Spam links someone hid in your pages, and scripts loaded from addresses criminals took over or anyone can buy.
Fake email in your name
Whether inboxes are told to reject email that pretends to come from your business.
Your secure connection
Whether every page opens securely and old, weak encryption is turned off.
Your domain
Its renewal date, and the lock that stops it being moved away from you.
One letter, like a health inspection.
One serious problem sets your grade, no matter how much else is fine. Anything we could not check keeps a site from an A.
- AStrong
- BGood
- CFair
- DPoor
- FFailing
Why this matters now
5 hours
is the median time from going public to the first attack, for the most-attacked WordPress flaws.
Patchstack, State of WordPress Security in 2026 46%
of WordPress plugin flaws had no fix from the maker when they went public.
Patchstack, State of WordPress Security in 2026 94
new security flaws that mention WordPress were published in three days in October 2026. 61 need no password.
NVD, published October 20 to 22, 2026Most of these problems go away with a rebuild.
Our websites have no plugins to patch, open securely on every page, and load only the code we choose.