Scan your WordPress site before you ship
WordPress powers a huge share of the web. Core is mature, but security headers, server config and SEO depend on your host, theme and plugins.
Free · No signup · Only scan sites you own or have permission to test
Common WordPress launch issues
🛡️ Security
- Many hosts don't send HSTS, Content-Security-Policy, X-Frame-Options or X-Content-Type-Options unless you add them via the server, a CDN or a plugin.
- Servers often advertise PHP versions through X-Powered-By.
- Plugins and themes sometimes embed third-party API keys in page scripts.
🔎 SEO
- Without an SEO plugin, pages may lack meta descriptions and Open Graph tags.
- A leftover 'Discourage search engines from indexing this site' setting adds noindex.
- Sites moved from HTTP can keep mixed-content image and script URLs.
⚡ Performance
- Uncached PHP pages can be slow to respond.
- Plugin-heavy pages may load lots of JavaScript and a large HTML document.
What ChillScan checks on your WordPress site
- ✓ Security headers and X-Powered-By
- ✓ HTTPS redirects and mixed content
- ✓ Cookie flags
- ✓ noindex, robots.txt, sitemap, meta and Open Graph
- ✓ Response time, compression and page weight
ChillScan reads only what a visitor's browser receives. It doesn't run JavaScript and can't scan pages behind a login or bot protection. See every check → · See a sample deep report →