How can we help?

Paste your URL and in about 5–30 seconds you get an A–F grade with the three issues that matter most. The free scan is passive and read-only: at most 15 normal requests that look at what any visitor already sees — TLS certificate, security headers, cookies, public pages, email-security DNS records and, for WordPress, public version info. Deeper tests run only after you verify you own the domain and give explicit consent.

Yes — the free scan only reads what any visitor's browser already sees (headers, certificates, public pages). No attacks and no load. Deeper tests are rate-limited and run only for the verified owner of a domain, after explicit consent.

The grade goes from A (strong) to F (weak) and comes with a 0–100 score. Issues are ranked by real-world risk, so the top three are the ones worth fixing first. After a fix, re-scan to watch the grade move.

HackGrade works with any public website — WordPress, Shopify, Wix, Squarespace, custom sites and more. Every site gets a grade; WordPress sites also get plugin, theme and core-specific checks, with fixes written for wp-admin.

That's the point of HackGrade: each fix is written step by step in plain language, with copy-paste snippets (for example .htaccess, nginx or wp-config lines) you can apply yourself or hand to your developer. Free shows fixes for the first 3 issues; paid plans unlock every fix.

Deeper tests probe a site more actively, so we run them only for its verified owner. Add your site in your dashboard and verify it in one of three ways: a DNS TXT record (covers the domain and its subdomains), a small file under /.well-known/ on that host, or a <meta> tag on your home page (both cover that exact host). We re-check verification right before every deep scan.

After you verify ownership and consent, a deep scan checks for exposed files (backups, .env, .git, config files), known CVEs in your server software, plugin and theme vulnerabilities, admin pages, open ports, login security (brute-force protection, session cookie flags), payment-page integrity and known misconfigurations. It is rate-limited, and every finding comes with step-by-step fixes.

Scan Authorization Agreement

Pro tests (Pro, Business and Agency plans) go further for online stores: scanning while logged in with a TEST account you provide, cart & checkout logic tests (for example price or coupon manipulation), and card-theft / skimmer detection on your payment pages. They run only on verified sites you own, with your consent.

HackGrade plans (US dollars): Free $0 · One-time report $29 (one payment) · Site $12/month · Pro $29/month · Business $49/month (up to 5 sites) · Agency from $99/month (20 sites; 50 sites $199/month). Paying yearly gives you 2 months free. You can cancel anytime (it stops the next billing). Refunds: one per customer, within 30 days, and only if no full report has ever been opened.

Yearly billing gives you 2 months free: Site $120/year, Pro $290/year, Business $490/year, Agency $990/year (20 sites) or $1,990/year (50 sites).

Each customer can get one refund, ever: within 30 days of purchase, and only if no full report has ever been opened on the account. Once any full report is opened, there are no refunds (this applies to the $29 one-time report and to subscriptions). A refund ends access to the report. Your statutory consumer rights still apply.

Refund & Cancellation Policy

You can cancel anytime; cancelling stops future billing. You can do it yourself with one click under Account → Plan; your plan stays active until the end of the period you paid for. A refund (one per customer) is possible within 30 days only if no full report has ever been opened.

Refund & Cancellation Policy

No. The free scan needs no account. Create one (Sign in → Create account) to add and verify sites, run deep scans and see your scan history.

On the sign-in page, click “Forgot password?” and enter your email. We'll send you a link to choose a new password; it works for 1 hour.

Sign in and open Account settings. You can change your email there (we send a confirmation link to the new address), change your password, sign out everywhere, or delete your account, which permanently removes your sites, scan history and alerts.

We collect only what the service needs: your account email, the sites you add and their scan results. The free scan stores the public scan result and a salted hash of your IP for rate limits. Deleting your account removes your sites, scan history, sessions and support chats. The Privacy Policy linked in the footer has the details.

Privacy Policy

No. We don't sell your personal data, and we don't share it for advertising. The Privacy Policy lists who processes it on our behalf and explains your rights.

Privacy Policy

No. We never ask for passwords or card numbers in the chat or by email. For Pro tests you give us a separate TEST account, never your own login.

Agency starts at $99/month for 20 client sites ($990/year) and $199/month for 50 sites ($1,990/year). It includes white-label PDF reports with your own brand, a client dashboard, and all Pro features on every site.

Deep-scan results can be downloaded as a polished PDF report (in all 6 site languages) by the site's owner. On Agency plans the PDF can carry your own logo and name instead of HackGrade's (white-label).

The free passive grade only reads public information, so you can check any public site with it. Deep and Pro tests are different: they run only on sites you have verified you own (or manage with the owner's permission, e.g. agencies), and only with explicit consent.

Scan Authorization Agreement