Why We Built BoonRisk
This started with late-night calls.
The Problem We Kept Seeing
We build WordPress sites. We maintain them. And increasingly, we were getting emergency calls:
"My site got hacked."
"I can't log in to my admin."
"Google says my site is dangerous."
Every. Single. Week.
The Pattern
Here's what we noticed: most hacks were preventable. Not theoretically preventable. Actually preventable.
None of this is exotic. None of it requires a security PhD. It's basic stuff.
But most site owners didn't know to check. And by the time they called us, it was too late. The site was already compromised.
The Recovery Process Is Painful
When a WordPress site gets hacked, here's what happens:
This takes days. Sometimes weeks. It's expensive. It's stressful. And it's preventable.
The Idea
One night, after spending six hours cleaning a hacked WooCommerce site, I thought: "What if we could just... automate this?"
Not the cleaning. That's complex. But the checking. The prevention. The "hey, you're exposed" warning before something bad happens.
What if site owners could see their security posture before a hack? What if they could fix issues before they become emergencies?
What if we could prevent these late-night calls in the first place?
Why It Didn't Exist
There are security plugins. Lots of them. But they focus on blocking attacks:
All useful. But they don't answer the simple question: "Is my site risky?"
They tell you about attacks they blocked. They don't tell you about vulnerabilities you haven't fixed.
Building BoonRisk
We started simple. What checks would have prevented the hacks we'd seen?
Then we added context. Not just "this is wrong" but "this is why it matters."
Because "X-Frame-Options header missing" means nothing to most people. But "your site can be embedded in fake login pages to steal credentials" makes sense.
Making It Free
We could have built this as a paid service from day one. But that felt wrong.
The people who need this most are often running small sites. Personal blogs. Small business sites. Community projects. They don't have budget for another subscription.
So we made the core free. Install the plugin. Run the assessment. Get clear, actionable results. No account required.
For agencies managing multiple sites? For teams that need monitoring and reporting? That's where paid plans make sense. But the essential security check? That's free. Always.
What We Hope Happens
Our goal isn't to sell software. It's to make WordPress safer.
If BoonRisk can prevent even a fraction of the hacks we've responded to, it's worth it.
If site owners start checking their security posture regularly, the WordPress ecosystem gets more secure. That benefits everyone.
You Can Help
We're in open beta now. The plugin works. The checks are solid. The reports are clear.
But we need feedback. We need real-world usage. We need to know what we're missing.
Install it. Try it. Tell us what works and what doesn't.
Let's make WordPress safer together.