Questions, answered.

Every audit scores six categories, two under each of three pillars:

Revenue — what the site earns

• Visibility — whether customers can find you on Google and in AI answers (ChatGPT, Gemini, Perplexity)
• Conversion — how much of your traffic turns into enquiries or sales

Risk — what can hurt or sue you

• Security — exposure to breaches, data loss and downtime, including known CVEs and out-of-date software you run
• Compliance — GDPR, cookies, and the European Accessibility Act, in force since June 2025

Experience — what customers feel

• Speed — every extra second of load time costs conversions
• Usability & design — where visitors get confused, stuck, or leave

You get one overall score, a score per category, and every finding ranked by what it costs you.

Usually a couple of minutes. We fetch your pages, run the full analysis, then email you a link to your report. You see a preliminary score on screen while it runs, and the full report opens in your browser — every finding ranked, with what it takes to fix it. Nothing to download, and the link keeps working, so you can send it to whoever does the work.

No. The audit runs entirely from the outside, exactly the way a visitor — or a search engine — sees your site. There is no plugin, no script tag and no access to your server or admin panel.

No account, no password, no signup flow. Enter a URL and an email address, and the report comes to your inbox.

We fingerprint the WordPress core version plus the plugins and themes your site exposes publicly, then match that inventory against a continuously synced mirror of published advisories. Nothing is guessed from a version number alone — the affected version ranges in each advisory are matched precisely.

Yes. Audited sites stay in our registry with their last-seen software inventory. When a new advisory lands that matches something you are running, we email you an alert — even if your audit was weeks ago.

We use it to send your report and to alert you if a new vulnerability affects your site. Nothing else reaches that address unless you ask for it: the monthly brief is a separate list you have to tick, kept apart from your alerts and with its own unsubscribe. No list rental, no resale, either way.

The audit only reads what any visitor can already load, so it is technically possible — but the report is written for the person who can act on it. If you are auditing a client or prospect site, send it to yourself.

The automated audit and the full report are free. If you want someone to actually fix what the report finds, get in touch — that part is the business.