Website Security Check
Website Security Check
Check sites you own or are authorized to test. This tool only reads what a normal browser visit already sees; it never sends exploit payloads.
Worried about the PHP security scare everyone is talking about? In October 2026 two serious flaws in PHP itself, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed. Because they live in the PHP engine, every site built on PHP is in scope: Magento, Shopware, WooCommerce, WordPress, Drupal, Joomla and more, even when your own code is perfectly clean. This checker gives you a fast, plain-language read on the part of the problem you can actually see from the outside, whether your site still advertises an old PHP version, plus the rest of your site’s basic security health.
How worried should you be? The flaws are rated highly (9.2 out of 10) and could, in the worst case, let an attacker run code on the server without logging in. But the e-commerce security firm Sansec updated its guidance on 22 October: wide, automated mass-attacks look less likely than first feared, the public exploits do not work against a normal PHP install, and you do not need to take your store offline. The one action everyone agrees on is simple: update PHP. This particular problem cannot be fixed from inside your store, theme or plugins. It is fixed by updating PHP on the server, or by asking your hosting provider to do it.
What this tool tells you about your site. It makes one ordinary request, exactly what a browser does when it opens your page, and turns the result into a short, colour-coded report: whether your PHP version is visible and whether it is out of date or past end-of-life; whether traffic is encrypted with a valid HTTPS certificate; whether visitors are kept on the secure version; whether the common protective headers are set; and whether a firewall or CDN such as Cloudflare sits in front. Every check is passive: it never sends an attack, it only reads what any visitor already sees. A version read from outside is a health signal, not a final verdict: confirm on the server with php -v. The current fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP 8.1 and older are end-of-life and need an upgrade or a backported package from your host.
- The October 2026 PHP flaw, in plain terms: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a bug in PHP itself, so any PHP site is in scope, including Magento, Shopware, WooCommerce and WordPress, no matter how clean your own code is.
- Do not panic, do update: mass attacks look less likely than first feared and you need not take your store offline, but the fix is to update PHP on the server (fixed releases 8.2.35, 8.3.36, 8.4.27, 8.5.12). It cannot be patched from store code.
- See your PHP health at a glance: the tool shows whether your PHP version is publicly visible and whether it looks outdated, unpatched or end-of-life, the first thing an attacker checks.
- HTTPS and certificate: confirms traffic is encrypted and the certificate is valid, trusted and not about to expire.
- Security headers and firewall: checks HSTS, Content-Security-Policy, clickjacking and MIME-sniffing protection, and whether a WAF/CDN like Cloudflare, Sucuri, Akamai, Fastly or CloudFront protects you.
- Passive and private: one ordinary request, no exploit payloads, nothing stored, and you can download the result as a PDF.
How do I use the Website Security Checker?
Type your website address (for example example.com) into the box and press Check. Within a few seconds you get a plain-language report with a colour-coded verdict and a list of findings. Use the Download PDF button to save it for your records or your developer.
Does this tell me if I am exposed to the October 2026 PHP flaw (PHP2Shell)?
It gives you a strong first signal: if your server still reveals its PHP version, the tool checks whether that version is outdated, unpatched or end-of-life for the October 2026 fix. It cannot confirm exploitability, which depends on your exact server setup. The definitive check is on the server itself: run php -v and look for the fix in your package changelog (fixed releases are 8.2.35, 8.3.36, 8.4.27, 8.5.12). If your PHP version is hidden or behind a firewall, the tool cannot read it, so check on the server.
My PHP is out of date, what should I do?
Update PHP to a supported, fixed release (8.2.35, 8.3.36, 8.4.27 or 8.5.12). If you run PHP 8.1 or older, either upgrade to a supported branch or ask your host for a backported fixed package, then restart PHP-FPM or Apache. If your hosting provider manages PHP, simply ask them to apply the October 2026 update. It is the single most impactful fix.
Frequently Asked Questions
Is this a vulnerability scanner?
No. It never sends exploit payloads and never tries to trigger a vulnerability. It only reads the HTTP response headers and TLS certificate that any browser already receives, and explains them in plain language. For a definitive check of a specific flaw like PHP2Shell, follow the official advisory and test on the server itself.
Do I need to take my store offline because of PHP2Shell?
According to Sansec’s 22 October update, no. Mass exploitation looks less likely than first feared and the public exploits do not work against a normal PHP install. The right action is to update PHP to a fixed release, not to pull your store down.
The tool cannot read my PHP version, is that bad?
Usually the opposite. Many servers hide their version with expose_php=Off or sit behind a firewall that blocks automated requests, both good for security. When the version cannot be read from outside, confirm it on the server with php -v.
My PHP shows as end-of-life, what now?
PHP 8.1 and older no longer receive official security updates (as of 2026), and there is no official fix for the October 2026 flaw on those branches. Upgrade to a supported branch (8.2 or newer), or ask your host for a backported fixed package. Running an end-of-life version means known holes stay unpatched, so it is the most important thing to fix.
Website Security Check
Check sites you own or are authorized to test. This tool only reads what a normal browser visit already sees; it never sends exploit payloads.
Worried about the PHP security scare everyone is talking about? In October 2026 two serious flaws in PHP itself, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed. Because they live in the PHP engine, every site built on PHP is in scope: Magento, Shopware, WooCommerce, WordPress, Drupal, Joomla and more, even when your own code is perfectly clean. This checker gives you a fast, plain-language read on the part of the problem you can actually see from the outside, whether your site still advertises an old PHP version, plus the rest of your site’s basic security health.
How worried should you be? The flaws are rated highly (9.2 out of 10) and could, in the worst case, let an attacker run code on the server without logging in. But the e-commerce security firm Sansec updated its guidance on 22 October: wide, automated mass-attacks look less likely than first feared, the public exploits do not work against a normal PHP install, and you do not need to take your store offline. The one action everyone agrees on is simple: update PHP. This particular problem cannot be fixed from inside your store, theme or plugins. It is fixed by updating PHP on the server, or by asking your hosting provider to do it.
What this tool tells you about your site. It makes one ordinary request, exactly what a browser does when it opens your page, and turns the result into a short, colour-coded report: whether your PHP version is visible and whether it is out of date or past end-of-life; whether traffic is encrypted with a valid HTTPS certificate; whether visitors are kept on the secure version; whether the common protective headers are set; and whether a firewall or CDN such as Cloudflare sits in front. Every check is passive: it never sends an attack, it only reads what any visitor already sees. A version read from outside is a health signal, not a final verdict: confirm on the server with php -v. The current fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP 8.1 and older are end-of-life and need an upgrade or a backported package from your host.
- The October 2026 PHP flaw, in plain terms: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a bug in PHP itself, so any PHP site is in scope, including Magento, Shopware, WooCommerce and WordPress, no matter how clean your own code is.
- Do not panic, do update: mass attacks look less likely than first feared and you need not take your store offline, but the fix is to update PHP on the server (fixed releases 8.2.35, 8.3.36, 8.4.27, 8.5.12). It cannot be patched from store code.
- See your PHP health at a glance: the tool shows whether your PHP version is publicly visible and whether it looks outdated, unpatched or end-of-life, the first thing an attacker checks.
- HTTPS and certificate: confirms traffic is encrypted and the certificate is valid, trusted and not about to expire.
- Security headers and firewall: checks HSTS, Content-Security-Policy, clickjacking and MIME-sniffing protection, and whether a WAF/CDN like Cloudflare, Sucuri, Akamai, Fastly or CloudFront protects you.
- Passive and private: one ordinary request, no exploit payloads, nothing stored, and you can download the result as a PDF.
How do I use the Website Security Checker?
Type your website address (for example example.com) into the box and press Check. Within a few seconds you get a plain-language report with a colour-coded verdict and a list of findings. Use the Download PDF button to save it for your records or your developer.
Does this tell me if I am exposed to the October 2026 PHP flaw (PHP2Shell)?
It gives you a strong first signal: if your server still reveals its PHP version, the tool checks whether that version is outdated, unpatched or end-of-life for the October 2026 fix. It cannot confirm exploitability, which depends on your exact server setup. The definitive check is on the server itself: run php -v and look for the fix in your package changelog (fixed releases are 8.2.35, 8.3.36, 8.4.27, 8.5.12). If your PHP version is hidden or behind a firewall, the tool cannot read it, so check on the server.
My PHP is out of date, what should I do?
Update PHP to a supported, fixed release (8.2.35, 8.3.36, 8.4.27 or 8.5.12). If you run PHP 8.1 or older, either upgrade to a supported branch or ask your host for a backported fixed package, then restart PHP-FPM or Apache. If your hosting provider manages PHP, simply ask them to apply the October 2026 update. It is the single most impactful fix.
Frequently Asked Questions
Is this a vulnerability scanner?
No. It never sends exploit payloads and never tries to trigger a vulnerability. It only reads the HTTP response headers and TLS certificate that any browser already receives, and explains them in plain language. For a definitive check of a specific flaw like PHP2Shell, follow the official advisory and test on the server itself.
Do I need to take my store offline because of PHP2Shell?
According to Sansec’s 22 October update, no. Mass exploitation looks less likely than first feared and the public exploits do not work against a normal PHP install. The right action is to update PHP to a fixed release, not to pull your store down.
The tool cannot read my PHP version, is that bad?
Usually the opposite. Many servers hide their version with expose_php=Off or sit behind a firewall that blocks automated requests, both good for security. When the version cannot be read from outside, confirm it on the server with php -v.
My PHP shows as end-of-life, what now?
PHP 8.1 and older no longer receive official security updates (as of 2026), and there is no official fix for the October 2026 flaw on those branches. Upgrade to a supported branch (8.2 or newer), or ask your host for a backported fixed package. Running an end-of-life version means known holes stay unpatched, so it is the most important thing to fix.