EXAMPLE REPORT · Sample data; no real website was checked
sample.example.org
Your website. A clearer next step.
Website security report
Your results at a glance
Ask your host to check your PHP updates.
This check found 1 PHP update warning, 2 recommended improvements. 7 checks found no issue in the responses reviewed; 1 could not be assessed or did not apply. 2 information-only observations are listed separately.
The PHP version shown by your website is listed as needing a PHP2Shell fix. Your host can confirm whether the fix is already installed.
3issues to reviewWhat we found and what to do next, with a clear explanation for each issue.
Your next steps
Your PHP version may need an updateWebsite host · high priority
Ask your website host to confirm the fixes for both PHP2Shell issues in the PHP version running your website. If an update is needed, have the host back up the site, check compatibility, and confirm the update is running everywhere.
Keep visitors on a secure connectionServer team · low priority
Ask your host to review this setting after confirming secure connections work across your website. Changes that also affect other parts of your website need extra care.
Help browsers handle files safelyServer team · low priority
Ask your host or developer to check that files are labelled correctly and review adding this protection.
Your PHP version
These are the PHP versions your website shared. If they differ, ask your host which version your website is using.
PHP/8.4.26x-powered-by · HTTP 200 · https://sample.example.org/Listed as needing a PHP2Shell fix
PHP lists fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Your host should check older versions, newer versions we haven’t reviewed, and any security fixes supplied separately by your host.
Issues and what to do next
Check soon
01 Your PHP version may need an update
The PHP version shown by your website is listed as needing a PHP2Shell fix. Your host can confirm whether the fix is already installed.
What to do
Ask your website host to confirm the fixes for both PHP2Shell issues in the PHP version running your website. If an update is needed, have the host back up the site, check compatibility, and confirm the update is running everywhere.
How to check the fix
Ask your host to confirm both PHP2Shell fixes, including any fixes supplied separately by the host, in the PHP version running your website.
Technical details +
Your PHP version may need an update · PHP-001 · medium confidence
WHAT WE FOUNDx-powered-by: PHP/8.4.26Source: https://sample.example.org/
Confirm CVE-2026-109618 and CVE-2026-109619 fixes, package provenance, vendor backports and all web-serving PHP workers.
Website host
About this check +
A version shown by a website does not prove which fixes are installed. We did not try an attack. A command-line PHP version can differ from the PHP version running the website.
Extra protection
02 Keep visitors on a secure connection
This setting tells a visitor’s browser to keep using a secure connection after a trusted visit. Adding it can improve protection; a missing setting does not show that an attack happened.
What to do
Ask your host to review this setting after confirming secure connections work across your website. Changes that also affect other parts of your website need extra care.
How to check the fix
Ask the team making the change to check the website response and confirm the setting is working.
Technical details +
Keep visitors on a secure connection · HDR-001 · high confidence
WHAT WE FOUNDNo effective HSTS header observed.Source: https://sample.example.org/
Review Strict-Transport-Security only after validating HTTPS coverage. Do not enable includeSubDomains or preload without checking every affected host.
Server team
About this check +
We checked a small set of pages and responses. A service in front of your website may hide or change what the server shows.
Extra protection
03 Help browsers handle files safely
This setting helps browsers treat files as the type your website says they are. Adding it is a recommended security improvement.
What to do
Ask your host or developer to check that files are labelled correctly and review adding this protection.
How to check the fix
Ask the team making the change to check the website response and confirm the setting is working.
Technical details +
Help browsers handle files safely · HDR-004 · high confidence
WHAT WE FOUNDNo nosniff response header observed.Source: https://sample.example.org/
Review correct MIME types and X-Content-Type-Options: nosniff.
Server team
About this check +
We checked a small set of pages and responses. A service in front of your website may hide or change what the server shows.
Other checks
Secure connectionNo issue seen in this check
Certificate chain and hostname validated.
HTTPS helps keep information private as it travels between a visitor and your website.
Send visitors to the secure websiteNo issue seen in this check
HTTP response status 301.
Visitors using an HTTP address should be sent to the secure HTTPS version.
Security certificate expiryNo issue seen in this check
This setting helps stop other websites from displaying your page inside their own page. Some websites allow this on purpose. We check the two common ways to control it together.
Login cookie protectionDoes not apply
No Set-Cookie header observed.
We did not find a cookie we could clearly identify as a login cookie. This does not tell us whether all cookies are protected.
Secure page resourcesNo issue seen in this check
0 explicit HTTP resource reference(s); CSP upgrade-insecure-requests not observed.
We looked for files and images using an HTTP address in the page code. Browsers may block them or switch them to HTTPS. We do not run the page or check every link created by scripts or styles.
Secure form submissionsNo issue seen in this check
0 explicit HTTP form destination(s) on the HTTPS page.
A form that sends information to an HTTP address may expose what a visitor enters. We only read the form’s address; we never submit it.
Software information shared by your websiteReview suggested
PHP software banners were publicly advertised.
A website may show which software it uses. This can help with maintenance, but does not prove there is a security issue. This information alone does not create a report to buy.
A message for your website host
Copy this message to the team responsible for your website.
Need help with your results?
Talk through your results and next steps with our team.