This free scanner reads your website the way a visitor’s browser does, then tells you what is wrong and why it matters, in plain English. Usually in about ten seconds. No signup, no email address, and we never record your IP address.
We visit the site like any browser would and read what it sends back. We keep a log of the site and its result, never your IP address.
Reading your site…
Six things, each one a way real websites get broken into or embarrassed.
Whether your site works over a protected connection, whether visitors who start on the unprotected address are moved across, and whether browsers are told to insist on it. Without these, what your visitors type can be read on the way.
The instructions your site gives every browser: what code a page may run, whether it can be hidden inside another site, how cookies are treated. We read what each one actually says, because having one is not the same as having a useful one.
Passwords and secret keys that ended up in the code every visitor downloads. They are found by software that scans the web all day. We report only keys that are meant to be private, so a hit is almost never a false alarm.
Some sites publish a file that turns their scrambled code back into the readable original. It saves a developer time and saves an attacker even more.
An out-of-date WordPress, or a code library with holes that were made public years ago. Attackers do not need to be clever to use a hole that has a published recipe.
On WordPress sites, whether the list of usernames is open to anyone and whether an old remote-access door is still answering. Both make password guessing much easier.
The scan runs on our server, not in your browser. A web page cannot read another site’s settings, so we visit the site for you, as WPfoss-SiteCheck/1.0, and read what any visitor would receive. We send ordinary page requests and nothing else.
We do keep a log of the result: the site that was scanned (the address without anything after a question mark), its grade and findings, the country the request came from, the time, and whether the scan finished. That is how we see which problems are most common and improve the tool. We would rather tell you that plainly than claim otherwise. We keep it, and remove any site from it if you ask. What we do not keep: your name, your email address, your IP address, details of your browser, or any code or token from the scan, so nothing in the log points at a person. Your copy of the result is held in your own browser tab, so it can follow you to the contact form if you choose to write to us. It is gone when you close the tab. The site you scan is also kept out of this page’s address, so the analytics and advertising tools on this site are not sent it.
What the scanner does not do: log in, try passwords, look for hidden files, or send anything to the site except plain page requests. Full detail is in our privacy policy.
It is free and there is no signup. You do not enter an email address, and we do not ask for one.
Yes, and we would rather say so than pretend otherwise. We keep a log of the site that was scanned (without anything after a question mark), its grade and findings, the country the request came from, the time, and whether the scan finished. We do not keep your name, your email address, your IP address or details of your browser, and no tokens or script lists, so a scan is not linked to you. The log is kept, and we will remove any site from it if you ask.
Only what any visitor’s browser receives: the page you type in, the security settings the site sends with it, the site’s own script files and up to three published code maps. On a WordPress site it also reads two public addresses that WordPress exposes, and asks wordpress.org which version is newest. It does not log in, guess hidden files, send forms or ask the site’s database anything.
It reads only what any visitor would receive, so yes. Please use it on your own site, or on one you have permission to look at. It refuses private and internal addresses, and only checks public websites.
You are better placed than most, but no. This is a view from outside. It cannot see your logins, your server, your staff’s passwords or how your plugins behave inside. A clean result means nothing it looks for was wrong, and we will not invent work to sell you.
Because a fix done wrongly can take your site offline, and the right order matters. We explain what is wrong and why it matters, and fixing it safely is the job we do. If you would rather hand it to your own web person, the findings are written so they can act on them.
Treat it as already copied. Tell whoever looks after your site today, or tell us, and do not wait for a convenient moment. We only report keys that are private by design, so a hit here is rarely a false alarm.
Website security is part of the Security Review. We fix problems in stages so your site never goes offline, write down what changed, and run this check again with you at the end.