After PHP2Shell, the question that matters is which PHP version your site runs. This free check looks at your site from the outside in under 30 seconds. Then do the 2 minute check in our PHP2Shell post to be sure.
Is your WordPress site up to date?
A polite look from the outside: HTTPS, PHP and WordPress versions, public files, security headers and speed. Under 30 seconds.
We only look at public pages, the same way a browser does. We don’t log in, send forms or test for weaknesses. We log the address checked, with your IP, for 30 days to prevent abuse.
The health check is taking a short break.
You can do the 2 minute check yourself: log in to WordPress and go to Tools, Site Health, Info, Server to see your PHP version. Or book a free 15 minute call and we will check for you.
Checking
Get the full report by email
Not on WordPress?
We checked the basics that apply to any site. If you are planning a move to WordPress, or want a second opinion, we are happy to help.
This is a quick outside view, not a full security audit. We cannot see inside your server.
Up to 8 requests to public pages, the same things a browser can see. We don’t log in, send forms or test for weaknesses.
Your site loads over HTTPS, the certificate passes a browser’s checks, and plain http moves to the secure version.
If your server shows its PHP version, we compare it with the PHP2Shell fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
If your site shows its WordPress version, we compare it with the latest release from WordPress.org.
Whether the default readme.html file is public, and whether XML-RPC answers. Both come with every WordPress install.
Whether your site lists user accounts to anyone who asks. We count them. We never show or keep the names.
5 browser security headers, how fast your homepage answers and how much HTML it sends.
Some things only show up from the inside. Here is what this check can’t tell you.
We can’t see your plugins, themes, backups or hosting setup. Those need a look from the inside, with a login.
Hiding the PHP version is good practice, so we often can’t see it. In WordPress, go to Tools, Site Health, Info, Server. It takes 2 minutes.
A good score means nothing obvious is wrong from the outside. It doesn’t prove a site is secure.
Yes. We make up to 8 normal requests to public pages, the same as a visitor’s browser. We don’t log in, send forms or test for weaknesses. Results are saved for an hour, so a repeat check doesn’t touch your site.
Many hosts hide it, which is good practice. Log in to WordPress and go to Tools, Site Health, Info, Server. If it says 8.1 or older, we will move your site free onto our maintenance plan.
We email you the full report and may follow up once about the results. We keep your details for 12 months, then delete them. Unsubscribe any time. See our privacy policy.
Tell us what the check found. We’ll tell you what to fix first and what it costs. No pitch deck.
