How to check your website security for free
Short answer: run a free passive scan (such as HackGrade’s A–F grade), then confirm the basics yourself: HTTPS with a valid certificate, the main security headers, SPF and DMARC records for your email domain, up-to-date software, and no public backup or config files. All of this can be checked from outside, safely, in about ten minutes.
Quick steps
- Run a passive scan. Get an overall grade and a prioritised list of issues without attacking anything.
- Check HTTPS and the certificate. Make sure http:// redirects to https:// and the certificate is valid and not close to expiry.
- Check security headers. Look for Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
- Check email records. Look up the SPF TXT record on your domain and the DMARC TXT record on _dmarc.yourdomain.
- Check software updates. Update your CMS, plugins and themes, and remove the ones you don’t use.
- Check for exposed files. Make sure files such as .env, .git and backups are not downloadable from your own site.
1. Run a passive scan
A passive scan reads only what any visitor’s browser can already see: your pages, response headers, certificate and public DNS. It doesn’t log in, submit forms or try attacks, so it is safe to run on a live site. HackGrade’s free scan does this and turns the results into an A–F grade with the first three fixes explained. How the A–F grade works.
2. Check HTTPS and the certificate
Your plain-HTTP address should answer with a permanent redirect (301 or 308) to HTTPS:
curl -sI http://yourdomain.com | head -n 3Then read the certificate’s dates and issuer:
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -datesMore detail in Is my SSL certificate configured correctly?
3. Check security headers
curl -sI https://yourdomain.com | grep -iE 'strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy'Missing lines mean missing headers. The security headers guide has copy-paste fixes for nginx, Apache, Cloudflare and WordPress.
4. Check email records (SPF and DMARC)
dig +short TXT yourdomain.com | grep -i spf
dig +short TXT _dmarc.yourdomain.comNo SPF or DMARC record means anyone can send email that claims to be from your domain. See SPF, DKIM and DMARC in plain language.
5. Check software updates
In WordPress, open Dashboard → Updates. Outdated plugins are the most common way small sites get hacked. See how to find outdated plugins with known vulnerabilities.
6. Check for exposed files (your own site only)
Each of these should return 403 or 404, never 200:
for p in .env .git/HEAD wp-config.php.bak backup.zip; do
printf '%s ' "$p"; curl -s -o /dev/null -w '%{http_code}\n' "https://yourdomain.com/$p"
doneIf anything returns 200, follow Block exposed .git, .env and backup files and rotate any passwords or keys the file contained.
What a free check can’t see
A remote check sees what the internet sees. It can’t read your server’s files, database or hosting panel, so a good grade is a strong signal, not a guarantee. Deeper tests (exposed files, injection tests, checkout logic) should only run on a site you own, with permission. HackGrade runs them only after you verify the domain and accept the scan authorization agreement.
Frequently asked questions
Is it legal to scan my own website?
Yes, checking your own website is fine. A passive scan only reads public information, the same as a browser. Active tests should only be run on sites you own or are authorized to test.
Will a security scan slow down or break my site?
A passive scan makes a small number of ordinary requests, similar to one visitor, so it does not affect a normal site.
How often should I check my website security?
After every significant change (new plugin, theme, host or DNS change) and at least monthly. Certificates expire and new plugin vulnerabilities are published every week.
Does a good grade mean my site can’t be hacked?
No. It means the issues visible from outside are in good shape. Keep software updated, use strong unique passwords with two-factor login, and keep tested backups.