Is the health check really free?

Yes. The scan costs nothing and has no obligation. Paid patching is optional.

Does the scan change anything on my site?

No. It makes one normal page request, like a visitor would, and follows up to three redirects.

How often can I scan?

Each site can be scanned once per day, and each IP address has a daily limit to keep the service fair.

What do the risk bands mean?

Low (0-24) means few exposed weaknesses were found. Elevated (25-54) means a few should be fixed soon. High (55-100) means several serious signals were found and you should act quickly.

Can the scan find out if I was hacked?

No. External scans cannot see inside your server. Read our guide "How to check if your PHP site was hacked" for a step-by-step review.

Free PHP health check

A passive, one-minute check of your public website. See your PHP exposure, HTTPS, and security headers in plain English.

How to check your site in three steps

1
Enter your site address
Use your homepage address, for example https://yourdomain.com. Only http and https on ports 80 and 443 are accepted.
2
Give your email and consent
We send a confirmation to your inbox and use it only for your scan follow-up. You can unsubscribe at any time.
3
Read your risk band
You get a score from 0 to 100 and a band: Low, Elevated, or High, plus the findings behind it.

What the check looks at

Whether your homepage loads over HTTPS and redirects HTTP to HTTPS
Whether your PHP version is exposed in server headers, and whether that version is behind the latest security release
Five common security headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
Whether WordPress or WooCommerce appears to be in use on the homepage
Whether a CDN or web application firewall is in front of the site

What it cannot tell you

It does not scan ports, guess file paths, or try exploits. It reads your public homepage only.
It cannot tell whether your site has been hacked. Use our hack-check guide for that.
A matching version number does not prove a site is safe, because some hosts backport security fixes without changing the version.

Frequently asked questions

Is the health check really free?: Yes. The scan costs nothing and has no obligation. Paid patching is optional.
Does the scan change anything on my site?: No. It makes one normal page request, like a visitor would, and follows up to three redirects.
How often can I scan?: Each site can be scanned once per day, and each IP address has a daily limit to keep the service fair.
What do the risk bands mean?: Low (0-24) means few exposed weaknesses were found. Elevated (25-54) means a few should be fixed soon. High (55-100) means several serious signals were found and you should act quickly.
Can the scan find out if I was hacked?: No. External scans cannot see inside your server. Read our guide "How to check if your PHP site was hacked" for a step-by-step review.