Free
£0
One-off checks of any website, emailed to you.
Website security web app
HackSpot: is your website showing a known security problem?
HackSpot checks what your website shows publicly for known security problems, like this month's PHP2Shell flaws, and explains each one in plain English: how serious it is, who should fix it and a message you can send them. It also watches the online suppliers your business depends on.
- A free check in about a minute for any website, with no sign-up.
- Plain-language reports that say what was found, how serious it is and who should fix it.
- Supplier watch for the online tools your business depends on, checked every 5 minutes.
- Passive checks only. HackSpot never attacks, logs in to or stress-tests a website.
Watch
See it in 39 seconds
A 39-second look at HackSpot: enter your website and get a plain-language report of known security problems, like the PHP2Shell flaws, with who should fix each one and a message to send them.
Watch on YouTube (opens in a new tab)How it works
A plain-English report in three steps
- 1
Enter your website
Type your website address and the email where you'd like the report link.
- 2
We look, we don't touch
HackSpot visits your homepage like any browser would and reads your public email settings. Nothing more.
- 3
Get a report you can act on
Each finding shows how serious it is, who fixes it and a message ready to send them.
Features
What HackSpot checks
- Secure connection (HTTPS) including redirects and when the certificate expires.
- PHP and the PHP2Shell fixes whether your site shows signs of an unpatched PHP version.
- Software versions on show server, PHP, WordPress and other systems your site reveals.
- Browser security headers the settings that tell browsers to block common tricks.
- Fake email protection SPF, DMARC and DKIM for your domain.
- Exposed files and admin pages for verified websites: .git folders, .env files, backups and public login pages.
- Supplier status and security alerts from 255 suppliers' status pages and public alerts (CISA, NCSC, GitHub).
- 10 languages reports, alerts and guides in English, Spanish, French, German, Italian, Portuguese, Dutch, Polish, Swedish and Japanese.
Pricing
Start free, then watch your website and suppliers
Business
£9 a month
1 website checked daily and 10 suppliers watched.
Business Plus
£29 a month
3 websites, 30 suppliers and alerts to up to 5 extra people.
Agency
£99 a month
25 websites, up to 250 suppliers and your own logo on reports.
Prices are the full price. Cancel any time. Larger groups and agencies: Enterprise, let's talk.
Questions
Common questions
Is the check really free?
Yes. The one-off check is free and needs no sign-up. You see the report on screen and get a link to it by email.
Will the check harm my website?
No. HackSpot only looks at what any visitor's browser and public DNS can see. It never attacks a website, tries to log in or stress-tests it.
Does updating WordPress fix PHP2Shell?
No. PHP2Shell is in PHP, which your web host provides. Your host has to update or patch PHP. Some hosts patch it without changing the version number, so HackSpot tells you what to ask them.
Who fixes what the report finds?
Each finding says who usually fixes it: you, your web host, your web developer or your email provider, with a ready-to-send message for them.
Is there a plan for larger groups and agencies?
Yes. Enterprise covers a custom number of websites and suppliers, team accounts, branded (white-label) reports, invoice billing and priority support. Contact us on hackspot.amethystapps.com/contact-sales.
Find out more
- PHP2Shell: what small businesses need to doPlain-English guide to the October 2026 PHP flaws. (opens in a new tab)
- Live supplier statusIs your CRM, phone system or payment provider down? (opens in a new tab)
- GuidesA plain-English guide for every finding in the report. (opens in a new tab)
- Enterprise and agenciesCustom websites, suppliers, team accounts and white-label reports. (opens in a new tab)
See what your website shows the world
Free check in about a minute. No sign-up needed.