Catch hacked client sites before Google, or the client, does.
HackBeacon checks every site you look after once a day, from the outside, the way visitors and Google see it. You hear about cloaked spam, sneaky redirects, PHP errors, expiring SSL and broken email the day it starts.
From $3/month for 10 sites. No plugin, no login, nothing to install.
What gets checked
Built from real hacked-WordPress cleanups: spam shown only to Google, ad loaders hidden from logged-in admins, a blank index.html served instead of the homepage. Plus the everyday failures that hurt just as much.
Hacks and malware
- Redirects only phones, Google visitors or one country see
- Malware signatures: NDSW, Balada, SocGholish, pop-under loaders, obfuscated eval
- New script, iframe and form domains
- Rogue WordPress users and hex-named fake plugins
- A dropped index.html replacing WordPress
- Exposed database dumps, wp-config backups, .env and .git
SEO spam and indexing
- Cloaking: what Googlebot sees versus visitors
- Casino, pharma and Japanese keyword spam
- Hidden links and spam anchors
- Injected or foreign sitemaps, sudden URL growth
- robots.txt tampering and surprise noindex
Uptime and errors
- Reachability from Germany, the US and the UK
- HTTP 5xx, PHP fatal errors and WordPress critical-error screens
- Database connection errors and stuck maintenance mode
- Suspended-account and default server pages
- Slow homepage responses
SSL, domain and DNS
- Certificate validity and expiry (alerts at 14 and 7 days)
- Domain registration expiry via RDAP
- Nameserver and MX changes (hijack signs)
- http to https redirect
Email deliverability
- SPF: present, single, within 10 lookups, no +all
- SPF and DKIM match the mailbox provider (Google Workspace, Microsoft 365, Zoho…)
- DMARC present and enforced
- Spamhaus domain and IP blocklists
Security hygiene
- Outdated WordPress core and end-of-life PHP
- Mixed content on https pages
- Version leaks, username enumeration, XML-RPC
- HSTS and clickjacking headers
Built for how you work
One account covers every client site, with the right level of detail for whoever reads the report.
Developers and freelancers
Raw response headers, HTML as Googlebot and as a phone, redirect chains, DNS, SPF and DMARC records, and the full JSON snapshot of every scan. A REST API and webhooks for your own tooling.
Agencies
Paste hundreds of URLs with client labels, see problems first, export to CSV, and route alerts to Slack, Discord or a shared inbox. Re-check every site after a deploy with one click.
Marketers and SEO
Know when Google is being served spam, the sitemap fills with junk URLs, robots.txt blocks crawlers, or a page goes noindex, before rankings drop.
Site owners
Plain-English alerts saying what's wrong and what to do next, an all-clear email when it's fixed, and a checklist of everything that passed.
How it works
- Enter your email and confirm it.
- Pick a plan and pay with Stripe.
- Paste your clients' URLs, one per line, with an optional label.
- The first report arrives in about a minute. After that you hear from us only when something changes.
Made for developers
Everything in the dashboard is available as JSON. Trigger checks from CI after a deploy, pull status into your own dashboard, or send alerts to Slack.
curl -X POST https://hackbeacon.wesolvers.com/api/v1/check-all \ -H "Authorization: Bearer hb_…" curl https://hackbeacon.wesolvers.com/api/v1/sites/<id> \ -H "Authorization: Bearer hb_…" | jq '.checks[] | select(.status != "pass")'
Priced at cost
Run by a Codeable expert. The plans cover the servers, VPN exits, email and card fees, plus a small margin. Every plan gets every check. Cancel any time.
Solo
- Up to 10 sites
- Every check, daily, from 3 countries
- 20 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Pro Most popular
- Up to 50 sites
- Every check, daily, from 3 countries
- 60 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Agency
- Up to 200 sites
- Every check, daily, from 3 countries
- 150 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Questions
Do you need access to the site?
No. Everything is checked over public HTTP and DNS, as a visitor would see it. No plugin, no login, nothing to install.
Can it prove a site is clean?
No external scanner can. A backdoor that shows nothing to the public stays invisible from outside; in one recent cleanup, a well-known external scanner reported a compromised site as clean. HackBeacon catches the symptoms visitors and Google see. Pair it with a server-side scanner for files and the database.
How much traffic does it send?
About 50 requests per site per day: a few homepage loads, robots.txt, sitemaps, the WordPress REST index and a short list of files that should never be public. Plus DNS lookups.
Can I run a check right away?
Yes, per site or for all sites at once. Each site can be checked on demand once every 10 minutes, within a daily allowance (20, 60 or 150 checks depending on the plan). The daily checks don't count.
What if a firewall blocks the checks?
We fall back to the US and UK locations automatically. You can also allow our server's IP, 46.224.160.47, in the firewall.
What about false alarms?
The first scan learns what's normal for each site: its script sources, users and plugins. After that only changes are reported, and anything you mark as expected is never flagged again.
Who gets the alerts?
You, plus up to 5 extra addresses per account (a client, a colleague, a shared inbox), and optionally a Slack, Discord or custom webhook.
Start monitoring today
Enter your email and we'll send a link to confirm it.