Security
- Known security holes in WordPress add-ons
- Outdated code libraries
- Security settings and HTTPS
A hacked site or a browser warning loses customers fast.
In-depth website audit
Your website, checked in depth.
87 checks, every one that applies to your site, run on up to 20 of your pages, then a clear report that ranks what to fix first and explains how, in plain English.
- SecurityHack and malware signs, Google Safe Browsing, HTTPS and security headers, outdated code libraries, subdomain takeover
- Data exposureSecret keys in your code (including AI and database keys), open Supabase or Firebase databases and file storage, source code left downloadable, AI called from the browser, backups and database dumps, private files and open folders, test and admin sites
- Email and domainSPF, DKIM and DMARC, encrypted mail delivery (MTA‑STS), domain renewal and transfer lock, certificate expiry, DNSSEC
- Speed and phonesGoogle Lighthouse on a simulated phone, Core Web Vitals, server speed, page size, heavy scripts
- GoogleTitles, descriptions and headings on up to 20 pages, broken links, image descriptions, sitemap, link previews
- PrivacyPrivacy policy, trackers on your site, tracking that starts before consent, easy to contact
Running WordPress? We check the plugins, themes and core version your site shows publicly against 40,000+ known security holes. How we check it
- Read-only, nothing changed
- Ready in a few minutes
- One free re-check
Start your audit
01What you get
A report you can act on.
- An overall grade and a short summary of where your site stands.
- A priority roadmap: what to fix now, this month and when you can.
- Every issue explained: what we found, why it matters to your business, and how to fix it.
- Google speed scores from a test of your home page on a simulated phone.
- A private link to share with your developer, and a PDF you can save.
- One free re-check within 30 days to confirm your fixes.
Our own site
We run this audit on our own site.
On 12 October 2026 it found six things to fix on riyostudio.dev. We fixed all six the same day, and the next audit came back A+.
- Email spoofing protection (DMARC) now blocks fake emails instead of only watching for them
- Mail servers must now deliver our email encrypted (MTA-STS)
- A published security contact for researchers (security.txt)
- A stricter content security policy
- A CAA record naming who may issue our certificates
- Google descriptions for three inner pages
B6 issues
A+all clear
- Mozilla Observatory
- A+ · 120/100 (incl. bonus)
- Google Lighthouse
- 95 · 97 · 100 · 100
02What it checks
Six areas, one clear report.
Data exposure
- Secret keys left in your code, including AI and database keys
- Whether your Supabase or Firebase database and files are open to anyone
- Source code left downloadable, and AI called from the browser
- Backups and database files anyone can download
- Test and admin sites open to the public
The checks that catch the gaps AI-built sites most often ship with. Exposed data is the first thing attackers look for.
Email and domain
- Email spoofing protection (SPF, DMARC, DKIM)
- Domain renewal and transfer lock
- Security certificate expiry
Without email protection, anyone can send invoices that look like they came from you.
Speed and phones
- Google Lighthouse test on a simulated phone
- Page weight
- Scripts that slow the page down
Slow pages lose visitors before they ever contact you.
Google and visibility
- Titles, descriptions and headings across your pages
- Broken links
- Sitemap and structured data
Missing basics make it harder for Google to show your pages.
Privacy and trust
- Privacy policy
- Trackers on your site
- Tracking that starts before visitors agree
Visitors and privacy laws expect you to ask first.
03WordPress
Running WordPress? We check it properly.
Outdated plugins are the most common way WordPress sites are hacked. Attackers scan the internet for known weak versions and break in automatically, so we check yours the same way they would, without touching your site.
- We find the plugins, theme and WordPress version your site shows publicly, by reading each plugin’s readme file and your theme’s stylesheet.
- We check each one against more than 40,000 known WordPress security holes, from a database we refresh every day.
- We compare each one with the latest release on WordPress.org, so you can see what is out of date.
- We flag risky leftovers: remote access (XML-RPC) switched on, version details on show, plugins listed publicly and sample content still live.
Each problem comes with what to update, remove or switch off, in plain English.
40,000+known WordPress security holes checked
Every daythe database is refreshed
Only versions your site shows publicly can be checked.
Not on WordPress? Every other check on this page still applies.
04How it works
From web address to report.
-
01
Enter your site
Add your web address and confirm you own the site or are authorised to have it audited.
-
02
Pay securely
Stripe handles the payment, in your local currency in many countries, and emails you a receipt and an invoice.
-
03
Read your report
The audit runs straight after payment and your report is usually ready within a few minutes, at a private link.
05Questions
Before you buy.
Is it safe for my website?
Yes. The audit is read-only: it reads your public pages, a small number of well-known public addresses, the home pages of a few of your subdomains and, if your site uses one, your Firebase database’s public address, the same way a visitor’s browser could. It doesn’t try to log in or inject anything, and nothing on your site is changed.
Does my site need to be on WordPress?
No. The audit works on any public website. If your site runs WordPress, it also checks the plugins, themes and core version your site shows publicly against more than 40,000 known security holes.
Can I share the report with my developer?
Yes. Your report stays at a private link, and anyone you share the link with can view it, so you can send it to your developer or IT provider. You can also print it or save it as a PDF, and ask us to delete it at any time. If you use your free re-check, the new report replaces the old one at the same link.
Do I get an invoice?
Yes. Stripe emails a receipt and an invoice to the address you give at checkout. If it doesn’t arrive, email [email protected] and we’ll send you a copy.
What isn’t included?
The audit is a point-in-time check of what can be seen publicly when it runs. It isn’t a guarantee that your site is secure, and it doesn’t include active tests such as injection, access-control or business-logic attacks. Those need a full, authorised manual penetration test. Because the report is delivered as soon as you pay, the audit is generally non-refundable once delivered, except where the Australian Consumer Law requires a refund.