Audits that used to cost thousands.
1 free AI audit/month. No card required.
58 deterministic scanners and 4 AI engines run on every audit — you only spend tokens when the AI engines read your code. Annual billing saves 25%.
Annual = monthly × 9. Lock the launch price forever — it only goes up from here.
The most generous free tier in WordPress security.
- Unlimited deterministic audits
- All 58 scanners
- 1 AI audit / month (4 AI engines)
- Report card (A–D)
- Public directory listing
- Background queue
For active plugin & theme authors.
- 30 full audits / month
- Standard queue — start < 15 min
- Fix Plan with every audit
- Site monitoring (1 site)
- GitHub Actions + CLI
- PDF + embeddable badge
The compliance layer for WP agencies managing client fleets — on your own AI keys.
- Unlimited Standard, Advanced + Premium audits on your keys
- Same recommended model roster as hosted (comparable grades)
- Priority queue — start < 5 min
- Fleet dashboard + morning digest
- CRA / GDPR / WCAG / EAA reports
- Finding assignment + team seats (5)
- Keys encrypted at rest, used only for audit calls
For platforms and hosts running WordPress at scale.
- Unlimited Standard + Advanced audits
- 200 Premium audits / month (top ups available)
- Fastest queue — start < 2 min
- Everything in Agency
- 25 team seats + 500 monitored sites
- Dedicated success manager + SLA
- Custom SOC 2 / VPAT documentation
Agency runs on your own AI keys (BYOK) — already paying Anthropic, DeepSeek, or OpenAI? Audits run on your accounts with the same standardized roster (grades stay comparable). We charge for the platform; your providers charge for the compute. Setup takes two minutes in Settings.
Need more than your plan? Top up.
One-off purchases, never expire, work with every engine tier including Premium. Top ups draw down only after your plan's monthly allowance is used.
| Product | Price | Per audit | Best for | |
|---|---|---|---|---|
| Single audit 1 token · never expires | £4.99 | £4.99 | Trying a full AI audit once | Audit once |
| Token pack — 25 25 tokens · never expires | £99 | £3.96 | Busy weeks on any plan | Buy 25 tokens |
| Token pack — 100 100 tokens · never expires | £349 | £3.49 | Fleet work + Premium tier | Buy 100 tokens |
Token costs: Standard ×1, Advanced ×2, Premium ×5 per audit. Themes and optional engines cost 2 base tokens.
Choose how deep the AI reads.
Every audit runs the same 58 deterministic scanners. The engine tier decides which AI models review the findings — tokens multiply accordingly.
Standard
The full verification pass — security, quality and accessibility engines on the standard model tier. Included on every plan, including free.
Advanced
Stronger reasoning for logic flaws and auth flow. Required for wp.org pre-flight audits and cross-validated checks.
Premium
Triple-validated security — three frontier models audit independently, then reconcile disagreements. Premium findings also cluster into systemic refactor plans: one root-cause fix that eliminates a whole class of bug.
Every security scanner worth using takes time. WP HealthKit runs 62 verification layers — 58 deterministic scanners and 4 AI engines — and queues jobs so each one gets full attention. Higher tiers get priority slots. No shortcuts.
Upload → queue position shown immediately → priority processing → results
Side by side
What each plan unlocks
| Feature | Free | Pro | Agency | Enterprise |
|---|---|---|---|---|
| Audits included | Unlimited scans + 1 AI/mo | 30 / mo | Unlimited¹ | Unlimited¹ |
| Premium engine audits / month | — | 6 (via tokens) | 50¹ | 200¹ |
| Bring your own AI keys (BYOK) | — | — | BYOK Agency £149 | Per-engine choice |
| Queue priority (start within) | < 60 min | < 15 min | < 5 min | < 2 min |
| 62-layer verification engine | ||||
| Anti-malware & nulled plugin detection | ||||
| WP + WooCommerce compatibility | ||||
| Plugin conflict detection | ||||
| 4 AI engines (security, quality, a11y, performance) | 1 audit/mo | |||
| PDF report with code fixes | — | |||
| AI fix prompts | — | Unlimited | Unlimited | Unlimited |
| Fix Plan (Markdown + JSON remediation plan) | ||||
| Provenance receipt (signed, publicly verifiable) | ||||
| Systemic refactor plans (Premium engine tier) | — | Token packs | ||
| Dashboard & trend tracking | — | |||
| Site monitoring | — | 1 site | 100 sites | 500 sites |
| Auto-audit on plugin update | — | |||
| Critical & CVE email alerts | — | |||
| Free re-audit (within 14d) | — | |||
| API & MCP access | — | |||
| CLI tool | — | |||
| Webhook integrations | — | |||
| White-label PDF reports | — | — | ||
| Custom agency branding | — | — | ||
| Priority re-audits | — | — | ||
| Fleet dashboard (multi-client) | — | — | ||
| Morning compliance digest | — | — | ||
| CRA / GDPR / WCAG / EAA reports | — | — | ||
| Finding assignment workflow | — | — | ||
| Team seats | — | — | 5 seats | 25 seats |
| Bulk audit API | — | 5 at once | 10 at once | 10 at once |
| Priority support & SLA | — | — | — | |
| Dedicated account manager | — | — | — | |
| Get Started | — | — | — | Contact Us |
| Annual billing (save 25%) | — |
Automated audits complement but do not replace manual penetration testing for mission-critical applications.