We check your site from the outside, the way an attacker would — login page, XML-RPC, exposed version, readable data API. No passwords tried, nothing touched.
Not targeted — harvested. Bots scan every WordPress site on the internet around the clock.
Every plugin is software that must be patched forever. Miss one update and the door is open.
Plus the days your site is down or serving malware to your customers.
Free means free: no account, no credit card, no sales call unless you ask for one.