How it works
From address to action plan in three steps
SiteGraded looks at your site from the outside, the way bots and attackers do, then tells you what it found, how serious it is, and how to fix it.
- 1
Enter your website address
Type the address of a site you own or look after and choose Check my site. There's nothing to install and no login to your site.
- Works with any public website: WordPress, Shopify, Wix, custom-built and more
- One site at a time on Light; several at once on Pro
- 2
SiteGraded looks at it from the outside
It visits your site the same way a browser, a search engine or an attacker's bot would, and notes everything it can learn.
- Loads the page and reads its security headers, cookies and certificate
- Works out the platform, server and versions the site gives away
- Reads robots.txt, the sitemap and the SEO tags search engines use
- Pro goes further, with plugin checks, injection tests, email and DNS records, and scraping tests
- 3
You get a grade and a fix list
Every finding is ranked by how much it matters, explained in plain English, and paired with how to fix it.
- An overall grade from A+ to F
- A score out of 100 for each area
- The most important fixes listed first
Reading your report
What the grade and labels mean
The overall grade weighs security twice as heavily as the other areas. A single high-severity problem caps the grade at C+, so a broken certificate can't hide behind good SEO.
Grades
- AExcellent. Nothing serious, just the odd improvement.
- BGood. A few gaps worth closing.
- CFair. At least one real problem, or several smaller ones.
- DWeak. Several serious problems.
- FAt risk. Fix the high-severity items first.
Grades also carry a plus or minus, from A+ down to D-.
Severity labels
- HighFix now. Something an attacker or search engine will hit straight away, such as an expired certificate, software that no longer gets security fixes, or a site hidden from Google.
- MediumFix soon. A real weakness that needs a little more to exploit, such as no HSTS, insecure files on a secure page, or no meta description.
- LowWorth tidying up. Hardening and best practice, such as missing optional headers or published version numbers.
- OKChecked and fine, or useful to know, such as which CDN the site uses.
Light and Pro
Passive by default, deeper when you need it
Light: looks, never touches
Only the requests any visitor's browser makes: the page, the http:// version, robots.txt, the sitemap, and the certificate. It's safe on any public site, free, and needs no account.
Run a free scanPro: tests like an attacker would
Adds active tests, such as harmless injection probes and checks for exposed files, along with plugin vulnerability lookups, email and DNS records, blocklists and scraping tests. It's for sites you own or are authorized to test.
See every featureQuestions
Common questions
Will a scan change or break my site?
No. Light only makes the same requests a browser makes, about five per scan. Pro's active tests use read-only requests and harmless test values. None of them is designed to change or delete anything, but because they probe like an attacker would, Pro is only for sites you own or are allowed to test.
How long does it take?
A Light scan usually takes a few seconds. A full Pro scan takes from about a minute up to a few minutes, depending on the site and which checks you choose.
Will the scan show up in my site's logs?
Yes. Light identifies itself honestly as SiteGradedLight, so you can see exactly when it visited.
Do you keep my results?
Light results aren't stored. They're shown on the page and gone when you leave it. Pro keeps scan history only in your own browser, so you can compare scans over time.
Does a good grade mean my site is secure?
It's a good sign, not a guarantee. SiteGraded checks what's visible from the outside. It can't see your server's settings, your passwords or your code. Use it alongside updates, backups and good hosting.
Can I scan someone else's website?
Only with permission. Light is passive and harmless, but it's still polite and sensible to scan only sites you own or look after. Pro's active tests must only be run on sites you're authorized to test.
Get started today
A healthier, safer website is just a click away.
Enter your address and get your audit report in seconds. No credit card required.
Only scan sites you own or have permission to test. Results come from automated, surface-level checks. A clean report is a good sign, not a guarantee.