Website Security Scanner
Find outdated PHP, WordPress, Joomla, Drupal, Laravel or Symfony with known CVEs, exposed .env, .git and backup files — and get step-by-step fixes.
Passive scan: ordinary GET requests only, no attacks or login attempts. Scan only websites you own or manage.
What the scanner checks
The most common ways small business websites get hacked — in one report.
Outdated PHP and server
PHP, nginx and Apache versions compared with supported branches and the NVD CVE database — e.g. PHP 7.4 or 8.0 without security fixes, or 8.2 missing the latest patch.
WordPress, plugins and other CMS
WordPress core (official insecure/outdated status), plugin and theme versions, plugins removed from WordPress.org, Joomla, Drupal, Magento, PrestaShop, TYPO3.
Exposed passwords and code
Public .env, .git, wp-config.php backups, SQL dumps, ZIP backups, phpinfo(), laravel.log and debug.log — files that give away database passwords.
Laravel and Symfony debug mode
Ignition (CVE-2021-3129), Telescope, Horizon and Symfony Profiler left open in production, plus vulnerable libraries from a public composer.lock (OSV.dev).
HTTPS and security headers
HTTP to HTTPS redirect, HSTS, X-Frame-Options, X-Content-Type-Options, CSP, Referrer-Policy and version leaks in Server / X-Powered-By.
Old JavaScript libraries
jQuery versions with known XSS vulnerabilities, checked in the OSV.dev database.
Frequently Asked Questions
Yes. The scanner is passive: it sends about 20–35 ordinary GET requests, the same a browser or search engine bot would. It does not attack, log in, submit forms or try to exploit anything.
From free public databases, synced into our own CVE database every day: NVD by NIST (CVEs with CVSS scores for PHP, nginx and Apache), official PHP security advisories, the CISA catalog of actively exploited vulnerabilities (KEV), endoflife.date (support dates and latest patches), OSV.dev (PHP and JavaScript libraries) and the WordPress.org API.
Many well-configured servers hide version numbers (expose_php = Off, server_tokens off, security plugins). That is good practice — but it also means the scanner can only check what is publicly visible. Always verify versions in your hosting panel.
Take a backup of the current state for analysis, change all passwords (hosting, FTP, database, CMS admins), update the CMS, plugins and PHP, remove unknown files and admin accounts, and check whether the domain landed on a spam blacklist.
Check if your domain is on a spam blacklist →Want a comprehensive SEO analysis?
Security is one part of a healthy website. Check all SEO aspects in one report.
Run Full SEO AnalysisOther free SEO tools
Check other tools for analyzing your website