This is not a penetration test
A Checklamp report is a snapshot of what a site shows to strangers. It is useful for triage and for talking to a developer; it is not an audit, a certification, or a guarantee of safety.
Limits
- Only public responses are read. Anything behind a login, inside the application, or in the database is out of scope.
- Absence of a finding is not proof of absence. Files with unpredictable names, logic flaws and server-side misconfigurations are invisible to this method.
- A hidden PHP version cannot be verified remotely — the report says so instead of guessing.
- Results describe the moment of the check. Sites change; re-check after every deployment or update.
Use
Check sites you own or are authorised to review. Using the service to build lists of other people’s weak sites, to pressure third parties, or to resell “vulnerability reports” about domains you do not control is not permitted.
No liability
The service is provided as is, without warranty. Decisions taken on the basis of a report — including patching, migration or disclosure — are the responsibility of the site owner.
Third-party names
CVE identifiers and vendor names are used descriptively. Checklamp is not affiliated with the PHP project, CERT-EU, CISA or any hosting provider mentioned on this site.
Corrections: [email protected].