How easy is your website to hack?
Paste your URL for a free website security check: an instant grade from A to F, with the three issues that matter most. Then fix them with clear, step-by-step instructions.
From URL to fixed in three steps.
No installs, no plugins, no jargon. Just a clear grade and a clear path to a better one.
Paste your URL
We run a passive, read-only check of what your site already shows the public. Nothing is touched.
Get your grade
An A–F grade in seconds, with your top three issues ranked by real-world risk.
Fix it, step by step
Verify you own the domain to unlock the full report, deeper tests and copy-paste fixes.
Eight layers of your site, one grade.
The free grade looks only at public signals. Deeper tests run only after you verify ownership and give explicit consent.
TLS & certificates
Protocol versions, cipher strength, expiry and HSTS.
Free scanSecurity headers
CSP, frame options, referrer and permissions policies.
Free scanWordPress core
Version exposure, XML-RPC, user enumeration, debug output.
Free scanExposed files
Backups, .env, .git folders and config files left public.
After verificationKnown CVEs
Server software matched against published vulnerabilities.
After verificationPlugin vulnerabilities
Detected plugins and themes checked for known flaws.
After verificationPayment pages
Checkout integrity, mixed content and third-party scripts.
After verificationLogin security
Brute-force protection, 2FA hints and session cookie flags.
After verificationFixes written for your dashboard, not a textbook.
WordPress powers a large share of small-business sites, so that is where we go deepest. Every finding comes with instructions you can follow from wp-admin — or hand to your developer.
- Plugin & theme audit. Each one matched to known vulnerabilities, with the safe version to update to.
- Copy-paste fixes. Exact .htaccess, nginx or wp-config lines — no guesswork.
- Re-scan to confirm. Watch the grade move as each fix lands.
MediumAdd a Content-Security-Policy header
- Open .htaccess in your site's root folder.
- Paste the lines below at the very top and save.
- Click “Re-scan” to confirm the fix.
Copy# HackGrade fix · security headers Header set Content-Security-Policy "default-src 'self'" Header set X-Frame-Options "SAMEORIGIN" Header set Referrer-Policy "strict-origin"
Start free. Pay when you're ready to fix.
Website security plans in US dollars. Pay yearly and get 2 months free.
Pro
- 1 site
- Weekly deep scan, full report + alerts
- Test-account (logged-in) scanning
- Cart & checkout logic tests
- Card-theft / skimmer detection
- Leaked keys in your code + legal/compliance checks
Business
- Up to 5 sites
- All Pro features
- Weekly scans on every site
- Full report + alerts
Agency
- White-label PDF reports
- Client dashboard
- All Pro features on every site
Free grade
- A–F security grade
- Every issue and its severity (fixes locked)
- Monthly re-check for 1 site
One-time full report
- Every check once, Pro checks included
- $29 credit toward a plan within 14 days
- Full refund if it finds nothing to fix
- Yearly billing: 2 months free
- 14-day money-back guarantee on subscriptions
- Cancel anytime
Deep tests always require domain ownership verification and your explicit consent. · Checked this week · HackGrade
Security reports with your name on them.
Monitor 20 or 50 client sites from one place and send polished, white-label reports under your own brand — a new recurring service, without hiring a security team.
- Your name, your logo. PDF reports carry your brand, not ours.
- One dashboard. Every client's grade and trend at a glance.
- Client-friendly language. Plain-language summaries owners actually read.
About us
Website security in plain language. No jargon, no scare tactics.
HackGrade is built for site owners, freelancers and developers who want to know where they stand before someone else checks for them. Paste an address and get an A–F grade and the issues that matter most, plus a ready-to-copy fix in the full report. No security expertise needed.
- Look, don't touch: the free check never changes anything on your site.
- Depth for owners only: deep scans run only after you verify that you own the site.
- A fix, not just a warning: every issue in the report comes with a practical fix.
Good questions.
Is the free scan safe for my site?+
Yes. It only reads what any visitor's browser already sees — headers, certificates, public pages. No attacks, no load.
Why do I need to verify my domain?+
Deeper tests probe your site more actively. We only run them for the verified owner, with explicit consent.
I'm not technical. Can I still fix things?+
That's the point. Each fix is written step by step, with copy-paste snippets and plain-language context.
Do you support sites that aren't WordPress?+
Yes. Every site gets a grade; WordPress sites also get plugin, theme and core-specific checks.
What do I get for free?+
An A–F grade, every issue we found with its severity, and a monthly re-check for one site. The step-by-step fixes are locked: the one-time $29 report unlocks them for one scan, and the plans add weekly deep scans, alerts and more sites.
Can I cancel or get a refund?+
Yes — cancel anytime; cancelling stops the next billing. Money-back guarantee: subscriptions get a full refund of the first payment within 14 days; the one-time report gets a full refund within 30 days if it finds nothing actionable (or you haven’t opened it yet). One refund per customer. Your statutory consumer rights still apply.