NewPHP security fix released Oct 21, 2026. See if your site needs it.Check free →
Free public check

Know where your site stands.

Paste your address. In about ten seconds you get a clear score and plain-English next steps. Nothing installed. Nothing changed.

How it works in 3 steps

1Paste your address

Any public website you own or manage.

2Get your score

We run quick, read-only checks on your public basics: connection, browser protection, software updates, exposed files and email protection.

3Fix what matters

Each item comes with a plain-English fix, in order of importance.

Example report

This is what a result looks like. It uses a made-up site, not a real business.

73
Example
example.com
A few things could be tightened.
Example report for illustration only. Not a real site.
Results by category
OK
Connection security
Your site uses an encrypted connection.
Needs attention
Browser protection settings
Some browser protection settings are missing.
OK
Server software up to date
No outdated server software was found.
Needs attention
WordPress basics
Some WordPress settings reveal more than they should.
Needs attention
Files that shouldn't be public
A setup file may be publicly reachable.
OK
Exposed app keys
No exposed app keys were found.
Needs attention
Email spoofing protection
Email spoofing protection is incomplete.
How to fix
🔒 Unlock the $29 report for exact steps

What we check, and what we never do

What we check
  • Connection security
  • Browser protection settings
  • Server software up to date
  • WordPress basics
  • Files that shouldn't be public
  • Exposed app keys
  • Email spoofing protection
What we never do
  • Log in to your site
  • Change anything
  • Try to break in or guess passwords
  • Open or store your files or site content
  • Use your email for anything but your report

Why now

On October 21, 2026, the PHP project released security updates for two vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP versions before 8.2 no longer receive security updates.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert recommending prompt patching: read the CISA alert.

Most WordPress sites run on PHP, and updating WordPress alone doesn't update PHP. That's done by your host. Our scan shows your PHP version when your server reveals it, and shows you how to check it yourself when it doesn't.

Questions

Is the scan really free?

Yes. The score and the list of findings are free. The optional $29 report adds step-by-step fixes for your specific host.

Will it slow down or affect my site?

No. It makes a handful of normal requests, about what one visitor loading a few pages would make.

Does a high score mean my site is secure?

No. We can only see what's public. A good score means no issues were found in public checks. It's not a guarantee of security.

Do you need my password or access?

Never. We don't log in and we'll never ask for your password.

Refund policy

See our Terms. Monthly re-scans can be canceled anytime in one click from the "Manage or cancel" link in every re-scan email, or at sitesafetyscan.com/manage.