Free website assessment
You send me your site's address; I look from the outside at what runs under it and write down what I found, ordered by urgency. No access is needed, and the write-up is yours even if nothing follows.
Your site's address is enough. I reply within one working day.
- Price
- The first assessment is free. I charge for the work itself, if any follows.
- What it takes
- Your site's address. No access: I only look at what a browser downloads on every visit, and what can be read from public DNS.
- What you get
- A written account of what I found, in three groups: what is urgent, what is worth fixing, and what can wait. Every statement rests on a measurement you can check on your own site.
- Afterwards
- You decide. If you want me to look after the site, I also check it from the inside, and you get a fixed monthly quote. If not, the write-up stays with you.
- Write to me
- I reply within one working day.kristof@kristofkarner.com
- Written by
- Kristóf Karner — independent developer, Budapest
- Updated
- 24 September 2026
What do I look at?
Everything that can be found out from the outside, through a visitor's eyes and from public data:
- What runs under the site. The content management system and its version, the theme, the plugins visible from outside — and how far behind their updates are.
- Does it have a known flaw. I check the visible versions against public vulnerability databases: is there one among them that has been fixed, while the site still runs the old version.
- Is the address in order. The certificate's expiry, and whether the http and www versions lead to the right address.
- Does your email arrive. The domain's email authentication: can someone else send in your name, and does your own mail stay out of spam.
- Can search engines find it. Whether the site can be indexed, an accidental “do not index” flag, the sitemap, dead links, images that do not load.
- How fast is it, and how does it look on a phone. How heavy the page is, how long it takes to load, and whether it falls apart on a small screen.
- What the source gives away. Security headers, elements loaded without encryption, a key or test setting left in the page source.
- What catches a visitor's eye. Typos, outdated details, dead social links, statements that are no longer true.
What don't I look at?
The inside of the server does not show from outside: the state of the backups, the error log, the admin accounts, the full list of plugins. Those need access, and that is part of the takeover, if you hand the site over to me.
Nor do I do anything that could disturb the site: I do not submit forms, I do not try passwords, and I do not go looking for hidden files.
What a write-up looks like
A composed example, of a made-up site, with typical findings:
Urgent
- WordPress and two plugins visible from outside are several versions behind. One of the plugins has a known, fixed security flaw, and the site still runs the version from before the fix.
- The domain has no DMARC record: anyone can send email in your name, and the receiving server does not know what to do with it.
Worth fixing
- The http version does not redirect to the secure address, so anyone arriving through an old link sees a warning.
- The contact page links to a social media page that no longer exists.
Can wait
- The images on the home page are larger than they need to be: most of the page is images, which means a noticeable wait on a phone with a slow connection.
- Three typos in the footer, which means they appear on every page.
What I would do first in your place: update the two plugins, with a full backup beforehand, then add the DMARC record. The rest can wait.
The real write-up is longer, and at every point it says where and how I measured, so you can check it on your own site in a minute.
Questions about the assessment
Is it really free?
Yes. The write-up is yours and commits you to nothing: whether you ask for maintenance afterwards is your decision.
Why is it free?
Because this is how all my maintenance starts: first I need to see what runs under the site. That is also where it turns out how much work it needs, and what the monthly fee will be.
Does it need access?
No. I only look at what a browser downloads on every visit, and what can be read from public DNS. Access is needed for the takeover, if you hand the site over to me.
Do you look at non-WordPress sites too?
Yes. The part visible from outside is the same for any site; the points about plugins are left out where there is nothing to look at.
If you are curious what I find, send me your site's address. I reply within one working day.
kristof@kristofkarner.com