Our free website security check, explained

What the check looks at

When you enter your website address, our server visits your home page in much the same way a browser does. It makes a small number of ordinary requests: one over HTTPS (following redirects within your own domain) and one over plain HTTP to see whether visitors are sent to the secure version. From those, we look at:

• Website technology: signs of WordPress, Joomla, Drupal, Shopify, Wix and other platforms, plus server software and frameworks that identify themselves. Each detection is labelled Detected, Likely, Not detected or Unknown, with the evidence we found.
• PHP: whether there's direct evidence of PHP (such as a header or PHP's session cookie) or whether we're inferring it (for example, "WordPress detected. WordPress normally runs on PHP."). We never label a site as PHP-free just because PHP isn't mentioned.
• PHP version: only if your server discloses it. We never guess. If it's hidden, we show "Not Publicly Disclosed" and help you check it yourself.
• HTTPS and certificate: whether a secure connection works, whether HTTP redirects to HTTPS, whether the certificate is trusted and matches your domain, and when it expires.
• Security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and clickjacking protection.
• Public technology disclosures: software names and version numbers your site advertises.
• Availability: whether your home page responds, its status code and how quickly it starts responding (a single measurement, so a rough guide only).

What the results mean

• GoodWe verified this and it looks fine.
• Attention recommendedA configuration improvement we'd recommend. Not an emergency, and not a sign of a compromise.
• Action requiredSomething that should be dealt with soon, such as an invalid certificate or an end-of-life PHP version.
• Unable to verifyWe couldn't check this from outside. That's not a pass: it needs checking another way.
• InformationA neutral fact about your site, such as the platform it's built on.

We deliberately don't give an overall security score. A passive outside check can't measure how secure a website really is, and a score would suggest otherwise. Instead, the Website Health Overview counts what we verified, what we recommend and what we couldn't check. A website whose PHP version we can't see never gets a clean bill of health.

What the check doesn't do

This is a preliminary external assessment, not a full vulnerability scan or security certification. We don't log in, guess passwords, probe for vulnerabilities, send attack traffic, crawl your pages or download files. We don't run any code from your website. So there's a lot we can't see: plugins, user accounts, malware, backups, server configuration and more.

If a firewall or bot-protection service (such as Cloudflare) blocks our request, we'll tell you, and limit our conclusions accordingly. That's often a sign of good protection rather than a problem.

Where our PHP data comes from

PHP support dates come from PHP.net. Latest releases come from PHP.net's release information, and security advisories from the PHP project's published advisories. Both are refreshed automatically several times a day. Each PHP result shows its sources and when they were last updated.

How we keep the checker itself safe

Because anyone can enter an address, the checker only connects to public websites on the standard web ports. It refuses internal and private network addresses (including after redirects and at the moment of connecting), limits how much it downloads and how long it waits, and limits how often each visitor can run checks.

Your information

You don't need an account or email address to use the checker. Results are kept briefly in memory, and our logs record the domain checked and a scrambled form of your IP address to prevent abuse. If you choose to contact us, you decide whether your report is included. Full details are in our privacy policy.