Have a web emergency? We'll fix your site free! →
Weak security headers leave your site open to cross-site scripting, clickjacking and data leaks. Get your grade from Mozilla’s Observatory in about 30 seconds.
Example reportMozilla Observatory
Your real grade appears below in about 30 seconds.
Full stack performance
Graded by the Mozilla HTTP Observatory. The score and grade below are the exact values Mozilla reports, so they match the full report on MDN.
Headers are one layer. The 18 checks below lock down the file system, database, and admin surface attackers actually target.
The headers and settings browsers use to keep your visitors safe.
Headers are one layerA good grade doesn’t mean a clean site. Malware, weak passwords and old plugins need a deeper look.
Mozilla starts every site at 100 and takes points off for each missing or weak header.
Grades and scores are the exact values the Mozilla HTTP Observatory reports.
Our WordPress engineers harden it for you. Secure, or you don’t pay.
A full hands-on lockdown of your server, logins, headers and WordPress.
How many sites?
No commitment required. Includes the Secure or It’s Free Guarantee.
Security built in and kept up every month.
Starter $35, Growth $55, Pro $120 per month
We scan your site before we start and again when we finish, and we test logins, forms and checkout after every change. If we can’t resolve the issue within the agreed scope of work, no charge is applied to your account.
Quick checks you can run any time. No signup.
A plugin vulnerability surfaced and they audited, explained the risk, and fixed it, no downtime.
It runs your site through the Mozilla HTTP Observatory, which checks your security headers, cookies and redirects. The grade and score are the exact values Mozilla reports.
Every site starts at 100. Mozilla takes points off for missing or weak protections and adds a few for extra ones. A means strong, B and C have gaps, and D or F means you’re exposed.
Not on its own. Headers are one layer. Malware, weak passwords and old plugins can still put a site at risk, so pair this test with regular scans and updates.
Results are cached for an hour per site. Wait a bit, then run the test again. Some fixes also need a cache clear at your host or CDN.
Yes. Our Security Hardening service sets up headers and locks down the rest of your site. Every WP Farm hosting plan also includes Imunify360, KernelCare and a Cloudflare WAF.
Yes. No signup and no card. Run it whenever you change your site or hosting.
Let our engineers harden your site. Secure or it’s free.