Skip to content
Free website security audit

Is your website exposed to the PHP flaws?

A free check of what your website shows the world — its certificate, its security headers, its email records, and the PHP version it announces. No sign-up.

Start your free audit

Type it the way your customers do. We look at your home page and nothing else.

  • Free
  • No sign-up
  • Results in seconds
  • Read-only: nothing on your site is changed

What this website scan does

Read-only and safe on a live site: the same as one visitor opening your home page.

What we check

  • We requested your home page once, the way a visitor’s browser does.
  • We asked once for the same page over http://, to check whether it redirects to https://. We read where it pointed and did not follow it.
  • We read the certificate, the response headers and any cookies that response set.
  • We read your public DNS records — the same ones anybody can look up.

What we never do

  • We did not request any other page or file, including the ones free scanners usually try.
  • We did not send any input, payload or test traffic to your application.
  • We did not attempt to sign in, and we sent no cookie or credential of our own.
  • We did not scan a port, enumerate a subdomain, or look at anything behind a login.

What this scan can’t tell you

  • Whether your application has an injection, a broken access control or an exposed file — none of those are visible from outside a page load.
  • Whether your dependencies have known vulnerabilities, which needs your code.
  • Whether your cloud configuration is sound, which needs your account.
  • Anything at all about the parts of your product behind a login, which is most of it.
A clean result here means the part your visitors can see is in order. It is not a security assessment and should not be shown to anybody as one.