Free. Passive. In writing.

Awen Site Check

Type your website address. In about a minute you get a plain-language read of what it shows the world: security, speed, search and accessibility. Then a written report you can hand to anyone, whether you hire us or not.

Reads only what your site already shows a visitor. No scanning, no login, no probing. What that means.

Get the written report

Every finding above with what to do about it, as a page you can share with your developer. We save a copy and follow up once if something looks urgent. No mailing list.

What the check covers

Four things a visitor, a search engine, or an attacker already sees

Every check reads only what your site already shows to anyone who loads it. Nothing is probed, nothing is logged into, nothing is sent that a normal visitor would not send.

Security
  • The software versions your site advertises, matched against the public lists of known vulnerabilities
  • TLS certificate and security headers
  • Version numbers leaking in headers and tags
  • Login and XML-RPC endpoints left on defaults
Speed
  • Core Web Vitals on mobile and desktop
  • What is slowing the first paint: images, scripts, fonts, the host
  • Caching and content delivery in front of the site
Search
  • Titles, descriptions and headings on key pages
  • Indexing: robots, sitemap, canonical tags
  • Structured data and social previews
Accessibility
  • Automated checks against WCAG, the Web Content Accessibility Guidelines
  • Alt text, labels, language, keyboard focus
  • The fixes that take minutes versus the ones that take a sprint
What it does not do. The free check never tests your site for vulnerabilities. It does not send crafted requests, enumerate plugins by guessing paths, try logins, probe for backups or config files, or read server-side code. Those are useful, and they are illegal to do to a site without the owner's written permission, so they happen only inside a Full Site Review, under a signed authorization that names the site, the dates and the people.
How it works

A minute of the machine, then an hour of a person

Type the address

The automated check runs the passive tests above and shows you the result on this page, in plain language, as it goes.

Get the report

Leave an email and the same findings arrive as a page you can share, each with what to do about it. We keep a copy and a person at Awen reads it.

Decide what is next

Most sites need nothing from us. If something is open, the prices for every next step are on this page, so the report stays advice and not a pitch.

If something needs fixing

Prices up front, so the report is advice and not a sales pitch

Site Check

The automated passive review above, plus the written report. No scanning, no obligation, no mailing list.

Freeas many as you like

Full Site Review

With your signed authorization: active vulnerability scanning, a source-level review of custom code, your Search Console and analytics pulled into one view, and a prioritized fix plan with hours against each item.

  • Credited in full against a Fix Sprint booked within 30 days
  • Authorization form arrives within one business day of purchase
$1,200fixed fee

Fix Sprint

We close what the review found: patching, including plugins whose updates fail or whose licenses have lapsed, a web application firewall in front of the site, moving off software that will never see another fix, speed and search work.

  • 15 to 25 hours, $2,000 to $4,000 in total; the deposit is applied and the balance invoiced once the sprint is scoped
  • Hacked-site cleanup is priced on its own, $400 to $900 by severity
$2,000deposit

Watch

The Site Check runs on your site every night, and you hear from us only when something changes.

  • An email the day a plugin, theme or core version on your site appears on the vulnerability lists
  • A warning three weeks before your certificate expires
  • Uptime checks every five minutes, with a note when the site goes down and when it is back
  • A monthly report with the month's uptime
  • No access to your site needed. Cancel any time.
$150per month

Care

For WordPress sites that want someone to do the work. Scoped per site, because it needs admin access and it is a person's time.

  • Security updates applied within two business days of a release
  • Cloudflare in front of the site, managed
  • Up to an hour of small edits a month
  • Backups, if the site is hosted with us
  • Everything in Watch
From $300per month, scoped firstTalk to us

Why Awen

We run this on our own sites every night

Awen builds and hosts WordPress sites and web apps for our own brands and for clients, and we check every one of them nightly for the software versions and changes that precede a break-in. When two critical PHP bugs leaked in October 2026, that habit meant we knew where every site stood within two hours and had them all handled within a day and a half.

Read how we handled PHP2Shell →

What you get, free
  • A plain-language report you can hand to any developer
  • Findings rated by what they actually risk, not by fear
  • Prices for every next step, before you ask
  • No scanning of your site without your written permission
  • No mailing list, no follow-up sequence
Questions

The honest answers

Is it really free, and why?

Yes. The automated check costs us almost nothing, and the report takes a person about an hour to read and annotate when something is open. Some of the people who read the report hire us to fix what it found. That is the whole model.

Will you scan or test my site?

Not in the free check. We read what your site already shows the public and compare it against published information. Active testing happens only inside a Full Site Review, with a signed authorization from whoever controls the site.

I already have a developer or an agency.

Good. The report is written so that they can act on every item without us. Send it to them. We do not write findings to make anyone look bad.

What if the report finds nothing?

Then you get a short report that says so, with the date, and you know where you stand. That happens more often than you would think for well-kept sites.

Is the report a security assessment?

No. It is a point-in-time review of public information. It cannot see what is behind a login, inside your code, or on your server, so it cannot promise a site is safe. The Full Site Review goes further, under authorization, and still describes what it did and did not cover.

Prefer a person from the start?

Tell us about the site and we will run it for you

Form not loading? Open it in a new tab or write to us.