Website Security Check: Check your website's security

It fetches your page once like a normal visitor (following a limited number of redirects) and reads what the server reveals: the Server and X-Powered-By headers, the CMS generator in the HTML, six security headers, cookie flags, the TLS certificate, old TLS versions, the HTTPS redirect, and the domain's SPF, DMARC, and DKIM records. It compares detected versions against release data from endoflife.date and current security advisories. In this fictional example, example.com reports PHP version 8.2.28, is therefore likely affected, and receives a grade of F.

No, deliberately not. A vulnerability scanner actively probes a site, for example by sending test requests to many paths. Doing that to someone else's server isn't appropriate for a public tool. This check is passive: It doesn't attempt attacks or probe additional paths, but shows where your site appears vulnerable from the outside. For a more reliable answer, use the self-test on your server.

Each check starts at 100 points and deducts a weighted number of points for each issue: a current security advisory or invalid certificate costs many points, while missing security headers cost no more than 8 points in total. A score of at least 90 earns an A, 80 a B, 70 a C, 60 a D, and 50 an E; anything below that gets an F. If a current security advisory affects the detected version, the grade is capped at D; if server software is no longer supported, it's capped at C. Issues that aren't visible from outside don't cost points, so even an A does not prove a server is secure.

From the outside, you can only see what a server chooses to reveal. If it doesn't disclose a version, the verdict is “not detectable”: Hiding it is good, but says nothing about patch status. And an old version number may already be patched, because Debian, Ubuntu, and other distributions backport security fixes while retaining the old number. The check therefore says “likely affected”, “not detectable”, or “patched”, but never “secure”.

Check on the server with php -v. For web requests, though, the PHP-FPM or Apache version matters, not just the command-line version. The self-test command shows all PHP installations found, their versions, and the relevant settings. Some servers reveal the version externally in the X-Powered-By header; you can disable this with expose_php=Off.

You run a short, read-only command on your server and paste its output into the tool. The command doesn't start any programs; it only reads the package database and configuration files: the operating system and kernel, package versions of PHP, nginx, Apache, OpenSSL, MySQL, MariaDB, PostgreSQL, Redis, and Node.js, available updates from the package manager's local cache, whether a restart is pending, relevant php.ini values, and whether the package changelogs mention the fixes. Analysis runs in your browser: the output is neither sent nor stored. This also lets you check internal servers and assess distribution backports.

Two critical PHP vulnerabilities flagged by the BSI on 21 October 2026. According to the advisory, older versions going back to at least PHP 5 are also affected. Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are patched; the PHP team has provided backport patches for 7.4, 8.0, and 8.1. As temporary mitigations, the BSI recommends session.upload_progress.enabled=0, memory_limit=-1, a low post_max_size, and, for PHP 8.5, fatal_error_backtraces=0. These workarounds only make an attack harder; they do not replace updating.

No. Website Security Check is intended for website owners and admins. It assesses a website's software versions, security headers, TLS, and email records. It doesn't check whether a store is trustworthy, a site is used for phishing, or a site distributes malware.

The check is free and requires no sign-up. To avoid overwhelming servers with requests, it allows up to 10 checks per minute per IP address and 30 per minute per checked host. Results are cached for about 10 minutes. The check does not access addresses with private IPs, localhost, or credentials in the URL. Use the self-test for internal servers.