Is your software patched? Is anything exposed?
Current findings by severity, the posture of each site and server, and the per-site changelog for the period the pack covers. This is the half the scanner has always produced.
For agencies and small businesses being asked to prove it
A client sent you a security questionnaire. Answer it from records.
StackHound watches the sites and servers you run, trains your staff, and records which version of your policy they agreed to — then assembles both halves into one dated document for an insurer, a client, or an assessor. Every row is an observation with a date on it. Nothing in it claims you are compliant.
✓Exposed secrets ✓Confirmed vs. possible ✓Training records ✓Verifiable without an account
The questionnaire has two halves. So does the pack.
One document, generated on demand, for the reader who will spend four minutes on it — an underwriter working a renewal, an account manager processing a vendor review, or an owner filling in a form.
Are your staff trained? Have they acknowledged your policies?
Per person: which modules they completed, which version, on what date, with what score — and which version of your handbook they agreed to, with the exact words they agreed to.
It never prints the sentence “you are compliant.” If you want to assert that, you assert it — StackHound supplies what you assert it from. That distinction is deliberate, and it is worth losing a prettier document over.
Every row is a dated observation
“Rebecca Hall completed Phishing and the three tells (v1) on August 14, 2026, scoring 90%.” Not “Acme Plumbing meets the standard.”
No score, no grade, no green check marks
A single number for the whole pack is a verdict wearing a statistic’s clothes, and it is the first thing a reader would quote back at us. Counts and dates instead.
It lists what it does not cover
Unmonitored sites, staff with no record, controls we cannot see. A pack silent about its own blind spots is the failure we exist to avoid, in a nicer typeface.
The reader can verify it without an account
Each pack and certificate carries a verification code that reads back the organization, the dates and the status — and discloses nothing about your staff.
Staff training
Enroll colleagues by email; each gets a magic link, reads a short module and answers questions that are graded on our side, so the answer key never reaches the browser. On finishing, they can send the record to whoever asked for it. Learners are not billable users and never consume a seat.
Three modules, about five minutes each — phishing, paying the right people, and telling someone when it goes wrong. The record states what was completed, never that a requirement has been met. See the course →
Policy acknowledgment
Add your staff handbook or acceptable-use policy. Staff agree to the exact text, and the acknowledgment is recorded against that version’s SHA-256 — so it proves which words they saw, years later, even if you have lost the file.
Publish a new version and old acknowledgments are never silently re-pointed at it. The pack reports that eleven of fourteen staff are on the current version and three are not, which is the honest gap rather than a hidden one. The annual clock runs per person from their own date.
Policy acknowledgment and staff training are free on every plan, Free included — and the staff you enroll are not billable users, so a one-person workspace can still run acknowledgment across the whole team. The evidence pack itself is on Solo and above: you pay when someone actually asks you for the document.
Where the systems half comes from.
StackHound does not replace the tools admins already use. It reads them, correlates them, and grades what it finds — so the answer you hand over is the same one you work from every day.
Exposed secrets in your public assets
StackHound detects exposed secrets in your public site assets — without storing or validating the secret. Known prefixes plus an entropy floor, not regex alone. It is the one website-only finding that comes back confirmed rather than possible.
Outside-in website monitoring
Watch domains, headers, TLS, WordPress fingerprints, exposed services, DNS, third-party scripts, and public vulnerability matches.
Inside-out Linux agent
Bring in package versions, WordPress core and plugin versions, SSH configuration posture, Fail2Ban events, and ClamAV hits — with a Servers, Controls, and change-timeline view on Solo and above.
Evidence-graded findings
See why a finding was ranked, what matched your stack, whether it is confirmed or only possible, and what to do next.
Start free. Grow into the stack.
Built first for WordPress operators, agencies, and server admins who need clarity without a full security operations team.
Free is free and takes no card. Solo and Agency start with a 14-day trial, which does take a card — you are not charged until it ends, and you can cancel before then. Enterprise is still a conversation, because its limits are set per customer rather than sold off a page.
Free
$0
One site, watched for free. No card, no account gymnastics.
Sites1
Agent hosts0
ScanWeekly
DigestWeekly
- ✓ Weekly automatic scan, plus on-demand re-scan any time
- ✓ The same evidence grading as every paid tier — free is limited in scale, never in honesty
- ✓ Weekly risk digest
- ✓ Policy acknowledgment and staff training for the whole team — enrolled staff are not billable users
- – The evidence pack itself is Solo and above
Solo
$12 /month or $120 a year
For a freelancer or small team watching a handful of sites and one server.
Sites10
Agent hosts1
ScanDaily
DigestWeekly
- ✓ 10 monitored sites
- ✓ 1 Linux agent host — Servers, Controls, and a change timeline
- ✓ Daily scans, weekly digest
- ✓ Client-ready reports — the compliance evidence pack
- ✓ A second person in the workspace
Agency
$99 /month or $990 a year
The wedge tier — built for WordPress maintenance agencies running a client estate.
Sites100
Agent hosts10
ScanDaily
DigestDaily
- ✓ 100 monitored sites
- ✓ 10 Linux agent hosts
- ✓ Daily scans and a daily digest — a real morning brief across your estate
- ✓ Client-ready reports — the compliance evidence pack
- ✓ Up to 15 people in the workspace, with roles
- ~ API accesssoon
Enterprise
Larger fleets and security teams. Still a conversation — its real terms are a bespoke limit set, which a fixed price cannot express.
Sites1,000
Agent hosts100
ScanHourly
DigestDaily
- ✓ 1,000 monitored sites
- ✓ 100 Linux agent hosts
- ✓ Hourly scans, daily digest
- ✓ Client-ready reports — the compliance evidence pack
- ~ API accesssoon
- ✓ Custom limits by arrangement
Talk to us about a bigger estate.
Free, Solo and Agency you can start yourself. This is for Enterprise, or for anything that does not fit a plan — tell us about your sites and servers and a person will answer.