Website Security Checker

How it works

1. Enter your homepage or any page URL, for example https://example.com.
2. The tool fetches the page and records the response headers, cookies and the HTML it returns.
3. It requests the plain http:// address to see whether visitors are sent to HTTPS, then reads the live certificate and the negotiated TLS version.
4. It sends simple GET requests for well-known leak paths such as /.env, /.git/HEAD and /phpinfo.php, and checks the content of each answer so a friendly 404 page is never reported as a leak.
5. You get a score out of 100, the PHP2Shell verdict at the top, and every issue sorted by priority with a recommended fix.

What it checks

• PHP2Shell exposure — compares a disclosed PHP version with the fixed releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and tells you when the version is hidden and must be checked on the server.
• HTTPS and TLS — HTTPS in use, HTTP to HTTPS redirect, certificate validity and host coverage, TLS 1.2 or 1.3.
• HSTS — Strict-Transport-Security present with a max-age of at least six months.
• Security headers — Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and risky CORS settings.
• Exposed files — .env, Git metadata, phpinfo pages, server-status, composer.lock, .DS_Store, and on WordPress a wp-config backup and debug.log.
• Version leaks — Server, X-Powered-By and CMS generator tags that hand scanners your exact software versions.
• Cookies and content — Secure, HttpOnly and SameSite flags, mixed content and jQuery versions with known XSS bugs.
• security.txt — whether researchers have a published way to contact you.

Why it matters

Most website break-ins start with something boring: a forgotten .env file, an outdated PHP build, a debug page left online after a deploy. Attackers find these with automated scanners within hours of a new vulnerability going public. PHP2Shell is a good example: exploitation attempts were seen from 17 October 2026, days before the patch, because the details leaked. A hacked site also loses search traffic. Google flags compromised pages in Search Console, browsers may show warnings, and injected spam pages can drag down the whole domain.

How to improve your score

Fix the red items first. Patch PHP and restart every worker, delete any exposed file and change the passwords and keys it contained, then force HTTPS with a 301 redirect and HSTS. After that, add the missing security headers one at a time, testing Content-Security-Policy in report-only mode before you enforce it. Hide version numbers by turning off expose_php and the server tokens. Run the scan again after every change; the score updates straight away.

The full PHP2Shell checklist, including temporary mitigations when you cannot upgrade today, is in our guide to the PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619). For the certificate alone, use the SSL Certificate Checker, and to read every raw header, use the HTTP Header Checker.

Frequently asked questions

Is the Website Security Checker free and safe to run?

Yes. It is free with no signup. It only sends the same kind of GET requests a browser sends, carries no attack payloads, and never shows the contents of an exposed file. Results are not published anywhere.

Can it prove my site is not vulnerable to PHP2Shell?

Only when your site discloses its PHP version. Most well-configured sites hide it, which is good practice. In that case the tool says PHP was detected and explains how to check the real version on the server with php -v or your hosting panel.

Is this a replacement for a penetration test?

No. It is a fast outside-in health check that catches common, high-impact mistakes. It does not log in, test forms or look for flaws in your own code. Use it after every deploy and before you pay for a deeper audit.