How the website check works
Reviewed 22 October 2026 · PHPCheck
Enter your website address. We check for PHP warning signs and explain what needs attention.
How does it work?
- Enter your website address and confirm you have permission to check it.
- See the results and whether anything needs attention.
- If a full report is available, choose whether to buy it for $9.99 once.
What do you check?
We look at the PHP version your website shows, its secure connection, browser security settings, cookies, and insecure links or forms on the page.
What do the results mean?
A PHP warning means the version shown by your website may need a security update. Your website host can confirm which fixes are installed.
If PHP matches a version with the published fixes but other settings need attention, we explain that before you buy. If we can’t confirm the PHP updates or find nothing to fix, there is no report to buy.
Will you change my website?
No. We check information the website shares. We don’t log in, try attacks, or change anything on the website.
What can’t this check tell me?
It cannot confirm whether your website has been hacked or check every page, plugin, or private setting. Ask your host or developer to confirm the updates and review anything we find.
Technical details
We use ordinary GET requests and follow at most three redirects on the same host or its www equivalent. Every destination is checked. We never forward your browser cookies. One random nonexistent .php path may be requested if the main page hides its PHP version.
Each check allows six requests, 512 KiB per response, 1 MiB total response bodies, five seconds per request and eighteen seconds overall. Up to two checks run at once. Unrelated redirects and HTTPS-to-HTTP redirects are stopped.
Checks cover PHP response headers, HTTPS redirects, TLS certificate validation and expiry, HSTS, selected CSP settings, framing protection, nosniff, recognized session-cookie attributes and explicit insecure HTML references. CSP and cookie checks are limited; they do not reproduce full browser behavior or logged-in sessions.
Unknown releases, conflicting versions and host-supplied fixes need confirmation from the host. Software version information alone does not create a report to buy. We do not check private files, try exploit payloads, crawl the site, inspect malware, or audit SEO and accessibility.