Hack My Website: Pricing, Features & Best Use Cases

Our take: Use Hack My Website to run a pre-launch security scan of a site you own, since Starter at $24 per month gives three unblurred scans with ready-to-paste fix prompts for Cursor or Claude Code, while the Free plan blurs finding details.

Main limitation: Free shows only blurred vulnerability details with one scan per month, and every scan needs DNS or file proof of domain ownership.

By the AI Tool Atlas editors. Based on the vendor's official documentation; we have not tested this product hands-on. What “documented overview” means

Who should use Hack My Website

Use Hack My Website to run a pre-launch security scan of a site you own, since Starter at $24 per month gives three unblurred scans with ready-to-paste fix prompts for Cursor or Claude Code, while the Free plan blurs finding details. Based on the vendor's documentation, not on a hands-on test.

Best for: Indie developers shipping web apps

Also a good fit for

Small teams without a security engineer
Agencies auditing client sites

Consider another tool if free plan findings are blurred

Or if

Starter limited to 1 target and 3 scans/month
Requires DNS ownership verification and an account

Hack My Website pricing and usage limits

Prices checked Oct 1, 2026 on the official US pricing page. Official pricing ↗ Prices and limits change often.

Free access and trial conditions

Free: 1 website target, 1 scan per month, blurred details, 3 retests.

No separate trial; Free plan.

Paid plans: what changes as you upgrade

Free web

Free source (opens in a new tab)

Month

For: Seeing your score

Limits

1 website target
1 scan per month

1 more

3 complimentary retests

Includes

Executive PDF summary
Blurred vulnerability details preview

Starter web

$24/mo source (opens in a new tab)

Month

For: Solo founders

Limits

1 website target
3 unblurred full scans per month

Includes

15+ page PDF report
6-dimension AI Launch Score

2 more

1-click Cursor and Claude Code fix prompts
Unlimited retests

Pro web

$36/mo source (opens in a new tab)

Month

For: Growing startups

Limits

3 website targets
10 unblurred scans per month

Includes

GitHub repo integration (SAST)
API and GraphQL fuzzing

1 more

Priority queue, 3-minute turnaround

Agency web

$60/mo source (opens in a new tab)

Month

For: Agencies auditing clients

Limits

10 client targets

Includes

White-label PDF reports
OWASP Top 10 and CWE tagging

2 more

SOC 2 / ISO 27001 reference tags
Multi-client dashboard

Enterprise web

$2,500/yr source (opens in a new tab)

Year

Starting at $2,500 per year, custom scope, Net-30

For: Engineering teams needing audit evidence

Limits

Custom scope

Includes

Custom Semgrep rule authoring
Static egress IP

1 more

PR merge blocker bot

Usage caps, credits and extra costs

Enterprise starts at $2,500 per year with custom scope; page also offers INR billing.

Not stated.

What is Hack My Website, and how does it work?

Hack My Website runs an automated security audit of a website or web app using three engines: OWASP ZAP for dynamic testing, Nuclei for CVE templates and Semgrep for static analysis, covering 200+ checks in a 3-8 minute pipeline. Domain ownership is verified via a DNS TXT record before scanning. Results are summarized as an AI Launch Score (0-100) with technical evidence per finding, prioritized by exploitability. Each finding comes with a copy-paste fix prompt for Cursor, Claude Code or Windsurf, and targeted retests confirm remediation.

Hack My Website's official site: how the product presents itself. hackmywebsite.io, captured Oct 2, 2026

What you provide and what you get back

What you give Hack My Website and what comes back, from its documentation

You provide

Target website URL
DNS TXT record or validation file
GitHub repository (Pro)

You get back

AI Launch Score 0-100
Prioritized findings with technical evidence
Copy-paste fix prompts
PDF reports

Where you can use it

Platforms: Web
Account: Required
Engines: OWASP ZAP (DAST), Nuclei (CVE templates), Semgrep (SAST), Playwright crawler
Scan time: 3-8 minutes; Pro priority queue 3 minutes
Safety: Non-destructive, domain ownership verified first
Fix prompts: Cursor, Claude Code, Windsurf

Best use cases for Hack My Website

Scenarios are worked out by our editors from the documentation; the actual result depends on your input and plan.

Pre-launch security check of a SaaS or web app

Who: Indie developers
You provide: A staging or production URL you own
Expected result: Launch Score and prioritized findings
Plan needed: Free or Starter
Limitation: Details blurred on Free source (opens in a new tab)

Finding XSS, SQLi, CSRF and auth issues via DAST

Who: Developers hunting injection and auth flaws
You provide: Running web app routes and API endpoints
Expected result: DAST findings for XSS, SQLi, CSRF and auth issues
Plan needed: Starter and up
Limitation: Black-box scan only source (opens in a new tab)

Detecting leaked credentials and vulnerable packages in code

Who: Startups with a repo
You provide: GitHub repository
Expected result: Static scan for leaked secrets and vulnerable packages
Plan needed: Pro
Limitation: Repo integration needs Pro source (opens in a new tab)

Hack My Website features and their limits

Feature overview on the official site. hackmywebsite.io, captured Oct 2, 2026

OWASP ZAP, Nuclei and Semgrep scanning engines

Runs ZAP for runtime testing, Nuclei templates for known CVEs and misconfigurations, and Semgrep rules on source, merging output into one report. Broader coverage than one tool

Access: All plans (details blurred on Free)Limit: Only 3-8 minute automated checks source (opens in a new tab)

200+ checks including CVE templates

Executes over 200 automated checks covering headers, exposed .env secrets, auth logic and API endpoints. Wide first-pass audit

Access: All plansLimit: Not a manual pentest source (opens in a new tab)

AI Launch Score (0-100)

Converts findings into a 0-100 score in four readiness bands, weighting severity such as SQL injection or leaked credentials as blockers. Go/no-go signal

Access: Score on Free; 6-dimension on StarterLimit: Proprietary scoring source (opens in a new tab)

DNS verification of scan targets

Requires a DNS TXT record or validation file before scanning, so only the domain owner can run an audit. Legal authorization

Access: All plansLimit: You need DNS or hosting access source (opens in a new tab)

Hack My Website: strengths and limits

Where Hack My Website is strong

Free plan with one scan per month You can see your score before paying. documented source (opens in a new tab)
Clear monthly USD pricing Budget is predictable per month. documented source (opens in a new tab)
Multi-engine DAST and SAST in one report One report covers runtime and code issues. documented source (opens in a new tab)
Sample report available without sign-up You can judge report quality first. documented source (opens in a new tab)

Limitations to check before paying

Free plan findings are blurred You must upgrade to read what is wrong. documented source (opens in a new tab)
Starter limited to 1 target and 3 scans/month Frequent deploys may exceed 3 scans. documented source (opens in a new tab)
Requires DNS ownership verification and an account Cannot scan third-party sites you do not control. documented source (opens in a new tab)
White-label reports only on Agency plan Agencies need the $60 tier for client-branded deliverables. documented source (opens in a new tab)

How to use Hack My Website for running a security scan before launch

Set up Hack My Website

On hackmywebsite.io click Start Free Security Scan and create an account
Enter the target site and add the DNS TXT record or upload the temporary validation file (or HTML file) to prove ownership
Wait for the instant DNS or well-known check to confirm verification
Start the audit, which runs ZAP, Nuclei and Semgrep checks in 3-8 minutes

Example: running a security scan before launch

Open the results and read the AI Launch Score and severity counts
Open a High finding such as a missing HSTS header and read the engine and CVSS evidence
Click Copy Prompt and paste the fix directive into Cursor or Claude Code
Deploy the change and run a targeted retest of that finding

Review and export the result

Confirm the retest marks the finding as resolved
Check the Launch Score band moved toward Launch Ready (85-100)
Download the PDF report and confirm it matches your plan tier (unblurred on paid plans)

Hack My Website integrations and API

Native integrations and export formats

Export: PDF, Executive PDF report, White-label PDF (Agency)

API access and separate billing

Hack My Website has no public API in its official documentation. /docs not available; no public API described

Hack My Website alternatives by need

"Better suited" is based on documented features and pricing, not on a head-to-head test.

GitHub Copilot: better suited to

Cursor: better suited to

Claude: better suited to

Devin Desktop (formerly Windsurf): better suited to

Alternatives
Alternative	Pricing	Limitation
GitHub Copilot	—	—	Compare
Cursor	—	—	Compare
Claude	—	—
Devin Desktop (formerly Windsurf)	—	—	Compare

Explore Hack My Website further

Hack My Website pricing, plan by planEvery plan with USD prices, limits and what is free.Best Hack My Website alternativesTools for the same job, by need and starting price.Best AI coding toolsOur picks in this category, compared by price and free tiers.

If you are looking at Hack My Website

More coding tools

Guides and comparisons

Cursor rules

Hack My Website user reviews

No user reviews yet.

Used Hack My Website? Be the first to share your experience.

Write a review

Hack My Website FAQ

Why does Free show blurred findings?

The Free plan gives a score and an executive summary but blurs vulnerability details; Starter and above unblur them and add fix prompts. source (opens in a new tab)

How does domain verification work?

You add a lightweight DNS TXT record or upload a temporary validation file, which proves authorization and prevents scans of sites you do not own. source (opens in a new tab)

What does the Launch Score mean?

A 0-100 score in four bands: Launch Ready 85-100, Action Recommended 70-84, High Risk 50-69, Launch Blocker 0-49. source (opens in a new tab)

How many scans and targets does each plan include?

Free 1 target and 1 scan per month, Starter 1 and 3, Pro 3 and 10, Agency 10 targets with unlimited audits. source (opens in a new tab)

Can I retest one finding after fixing it?

Yes, targeted retests verify a fix: Free includes 3, paid plans unlimited. source (opens in a new tab)

Sources and review methodology

Official sources and verification dates

Hack My Website homepage homepage · checked Oct 1, 2026 · how it works, score bands, engines
Hack My Website pricing pricing · checked Oct 1, 2026 · plans

Not verified: Privacy, retention and training terms; API availability; Supported countries.

How we documented and maintain this page

Every fact about Hack My Website above comes from the 2 official pages listed here, last compared on Oct 1, 2026; we have not run Hack My Website ourselves, so it has no editorial score. How we check and re-check pages.

Article updated Oct 10, 2026; prices checked Oct 1, 2026. Outbound links to vendors are plain links; we do not earn commissions. How we review · Report an error