Who runs Checklamp, and what we refuse to do
Published · updated
Checklamp is a small tool built by a team that maintains websites for a living. This page says who we are, how the check works, and the things we deliberately do not do — because those limits are the reason the results can be trusted.
Who is behind it
Checklamp is a Mikero project. Mikero has been running and supporting websites — 1C-Bitrix shops, WordPress sites, PHP servers — since 2019, on infrastructure we administer ourselves. The checker was built out of that work: every day we answer the same question from clients, “is anything obviously open on my site?”, and the answer usually arrived too late, after a scanner had already found it.
The engine runs on our own server. The site you are reading is static and lives on Cloudflare Pages. There is no reseller in between, and no third-party analytics beyond a page-view counter without cookies.
How the check works
We send the requests any visitor or crawler sends — plain HTTP GET and HEAD to your site, plus public DNS lookups — and read the answers: status codes, headers, cookies, the HTML you serve, whether well-known paths like /.env or /phpinfo.php are readable. Everything on the method page is visible from outside by definition.
Nothing is written to your server, no port is scanned, no password is tried, no exploit is delivered. The scan is not anonymous from your side: the requests come from our address, and they appear in your access log like any other visitor's.
What we refuse to do
- We do not scan third-party sites in bulk. The check runs on a site you submitted. There is no “we scanned a million sites and found X% vulnerable” statistic here — that would be both a legal risk and a meaningless sample.
- We do not guess versions. When the PHP build is hidden, the report says “not disclosed”. A tool that invents a version is worse than one that admits it cannot see it.
- We do not sell a “hacked” verdict. The check tells you what is visible from outside. It cannot prove your site is clean, and we do not pretend otherwise.
- We do not store what we read. The engine keeps a hashed domain and the codes of the findings, not the page contents and not the file contents. Details on the privacy page.
Contact
Questions, false positives, a check that failed on your site, or a request to remove a cached result: hermes@mikero.ru. Security reports are welcome at the same address; there is also a security.txt.
If you run a hosting company or an agency and want the check under your own brand, say so in the same email — the browser extension and the widget are the two integrations we support today.
Questions
Is Checklamp a security company?
No. We are a web-maintenance team that built a check for the questions we answer every day. For a full audit — server access, code review, penetration test — you need someone doing that as their main work.
Can you fix what the report finds?
We can, for clients we already support. The report is written so that any competent developer can act on it without us: each finding names the change and the reason.
Why is the site in English if the team is Russian?
The first audience for this kind of check is international — most searches for a PHP build or a CVE come from English-language sources. The Russian version of the same engine runs at check.mikero.ru.