Free website security check: see what bots already know
We read what your site answers in public: certificate, exposed files, security headers, cookies, email records. Then you get one verdict and a numbered list of what to fix first.
What the check looks at
More than 60 automated checks in nine groups. All of them are things a stranger can learn from outside — which is exactly why they matter: bots learn them first.
Exposed files
.env, .git, database dumps, site archives, logs, phpinfo. Usually one download away, and the download holds the passwords.
Certificate and HTTPS
Expiry, issuer, chain, and whether the first request can still travel in plain text without HSTS.
Security headers
HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy — what tells the browser how to behave.
Cookies
HttpOnly, Secure and SameSite on session cookies. Missing flags turn one bug into a stolen login.
Server and platform
PHP branch and whether it still gets patches, server version tokens, CMS version exposure.
Domain and email
SPF, DMARC, MX, CAA, nameservers — whether someone can send mail as your domain.
How to read the result
There is no score out of 100. A number invites arguing; a named file does not. You get three things:
| What you see | What it means | What to do |
|---|---|---|
| Critical | Something is readable or forgeable right now — a public .env, an expired certificate, a downloadable dump. | Fix today. Each card names the file or header and the consequence. |
| Needs work | Nothing is exposed, but the site is missing defences that cost trust and traffic over months. | Fix this week. Start with number 1 in the list. |
| Clear | Every passive check came back clean at the time of the scan. | Nothing to do. Re-check after changes or monthly. |
This is a passive check: public responses only. It cannot see what sits behind a login, inside the database, or in server logs — no passive method can. What it can do is show the part of your site that is already visible to everyone else.
Check the site you are already on
The browser extension shows the same verdict without leaving the tab: one click on the icon, and you see criticals and the top three fixes. It also adds “Checklamp: check this site” to the right-click menu and to any selected domain.
Download the extension (ZIP) Or use the Telegram bot
Install: unpack the ZIP, open chrome://extensions, turn on Developer mode, click “Load unpacked” and pick the folder. Not in the Chrome Web Store yet — the unpacked build is the same code.
Guides and tools
Every page below answers one question with commands and dates, not with advice.
PHP version check
What a stranger sees in the headers, and the command that reads the build your server actually runs.
PHP end of life
Support dates per branch, and what an unsupported branch means when the next critical bug lands.
Patch checklist
The order of operations for the October 2026 RCEs: patch, reload workers, verify, hunt for evidence.
CVE-2026-109618
The first of the two PHP core bugs: what is visible from outside and what needs a shell to prove.
CVE-2026-109619
The second bug: code execution through state left behind between requests, and why it takes two requests.
X-Powered-By
How one response header publishes your build, how to remove it on Apache, nginx and FPM.
mod_php vs FPM
Why the PHP team rates mod_php as the most dangerous setup, and how to tell which one you have.
WordPress PHP version
Read it in Site Health or WP-CLI, then update it without breaking plugins.
Bitrix PHP version
Where 1C-Bitrix states the version, and the upgrade order that keeps the shop working.
FPM status page
The leak that publishes your build and your request structure — and the one line that closes it.
File checksums
Build a SHA-256 baseline, compare it later, and find the files that are not what they were.
Security headers
Six headers explained by what breaks without them, with copy-ready nginx and Apache config.
Browser extension
Check the site in the current tab with one click — manual install, no account.
Fixed versions
The build that closes the October 2026 RCEs, per branch and per package manager.
cPanel PHP version
Where cPanel and WHM keep the per-domain version, and how to switch it without breaking the site.
Exposed .env
A reachable dot-file is a database password in a URL: how to test, rotate and block dotfiles.
Exposed phpinfo
The page that publishes your build, ini paths and environment — and how to remove it.
Exposed .git
When /.git/HEAD answers, the whole repository can be downloaded. How to confirm and close it.
Questions
Do you break into my site?
No. We send ordinary public requests — the same ones a crawler or a browser makes — and read the answers. No port scanning, no password attempts, nothing written to your server.
Do I need to install anything or give server access?
Neither. The check runs from outside, which is also its limit: findings that require a login or a server shell are out of scope for this report.
Is the result really free?
Yes — the full report, every finding and every fix. Later there will be paid extras around it (monitoring, a branded PDF for clients), never a paywall in front of the result.
I'm not a developer. What do I do with this?
Send the report to whoever maintains the site. Each finding says what is visible, why it matters, and the exact change to make — in plain words, no exploit details needed.
Can I check a site that isn't mine?
The check is passive, but use it on sites you are responsible for or have permission to review. Don't use it to build lists of other people's weak sites.
Why does it sometimes find nothing?
Because a well-maintained site hides its files, sends the right headers and renews its certificate. A clean report means: nothing that this method can see was open at that moment.