Have a web emergency? We'll fix your site free! →
See your site’s security headers and get a grade from A to F. We also check your HTTPS redirect and flag version leaks.
HSTS, Content-Security-Policy, X-Frame-Options and more, each checked and graded.
Whether plain http sends visitors to the secure version of your site.
Headers that reveal your server or PHP version, which helps attackers pick their tools.
Straight answers about your results.
They’re instructions your server sends with every page. They tell browsers how to protect visitors, such as always using HTTPS or refusing to load your site inside a frame.
They’re set on the server or CDN, outside WordPress. Your host can add them in the server config or at Cloudflare.
Most won’t. A strict Content-Security-Policy can block scripts, so test it in report-only mode first.
Yes. It’s free and there’s nothing to sign up for.
Still unsure? Ask a WordPress expert
Quick checks you can run any time. No signup.
We set your security headers and lock down the rest of your WordPress site.