Free tool
Is your WordPress site well protected?
Give your site’s address: the tool looks at what anyone can see from outside, the HTTP headers, the list of accounts, forgotten files, the WordPress version and trackers loaded before consent.
A few public pages are read by our server, as a visitor would. No login attempt, and nothing is kept.
Your site’s home page address.
What the tool looks at
- The six security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- What informs an attacker: the list of accounts, the WordPress version, xmlrpc.php, readme.html and the server versions.
- Files that should not be online: debug.log, the .git folder, directory listing.
- Trackers (Google Analytics, Meta, Hotjar…) loaded before the visitor agrees.
- The tool only reads public pages: it tests no password and forces nothing.
The other free tools
- E-mail check SPF, DKIM, DMARC and MX: do your e-mails have what it takes to reach the inbox? Run the test
- Share preview Your page as Google, LinkedIn, Facebook and X show it, with what is missing. Run the test
- Speed test Response time, cache, compression, images to convert and scripts that block rendering. Run the test
- Query diagnosis The SQL queries of a WordPress page, the ones that repeat and the fields read one by one. Run the test