What this check does, and what it cannot do

What we send

• Requests to the site’s public address over HTTPS, with an ordinary browser-like User-Agent that identifies Checklamp.
• A fixed list of well-known paths (about forty), once each: /.env, /.git/config, common backup and dump names, phpinfo.php, server-status, a PHP-FPM status path. No wordlists, no fuzzing, no enumeration.
• Public DNS queries for the domain: MX, SPF, DMARC, CAA, nameservers.
• A single TLS handshake to read the certificate chain and its validity.

What we never do

• No port scanning, no service detection beyond the site’s own HTTP port.
• No authentication attempts, no password guessing, no session manipulation.
• No exploit payloads, no OOM or multipart floods, no request that could write to the server.
• No submission of forms, no crawling beyond the first page, no retention of page content.

What the result means

A critical finding means something is visible from outside right now — a downloadable file, an expired or untrusted certificate, a disclosed PHP version below the fix, an open status page. It is evidence, not a guess.

A clean result means the checks we can run found nothing open at that moment. It is not a guarantee: anything behind a login, inside the database, or in a file with an unpredictable name is outside this method.

If the PHP version is hidden, we say “not disclosed” instead of inferring it. Version numbers cannot be guessed reliably, and a wrong guess in a security report is worse than no answer.

Rate limits and fair use

Checks are limited per address and per host, and a host is not re-checked more often than every few minutes — the cached result is returned instead. Automated bulk checking of domains you do not own is not allowed; if you need to check many sites you manage, write to us first.

Contact

Method questions, false positives, takedown requests: [email protected]. Security reports about Checklamp itself: see security.txt.