Is Your Website Ready for the Next Vulnerability?
Scan your public website for runtime, TLS, certificate, container and known vulnerability risks.
Example result. Your report shows your own site.
How it works
- 1
Enter your address
Paste the public address of a website you are authorized to assess and confirm it.
- 2
We check from the outside
Safe, passive checks of availability, certificate, headers and the software your server announces.
- 3
We compare with known vulnerabilities
Detected versions are matched against a vulnerability database. Every conclusion shows its evidence.
- 4
You get a plan
Plain-language findings with step-by-step fixes, then a verification scan to confirm they worked.
What we check
Availability
HTTP and HTTPS reachability, redirects, response time, HTTP to HTTPS redirect.
TLS and certificates
Validity, expiry, issuer, chain, signature, protocol versions and weak cipher indicators.
Security headers
HSTS, CSP, nosniff, framing, referrer and permissions policies, cookie flags.
Technology
Web server, PHP, CMS and frameworks, identified passively and never assumed.
PHP runtime
Version confirmed, likely or unknown, matched to published vulnerabilities.
Certificate authority events
Your chain compared with known CA incidents, flagged only when intelligence supports it.
An example security report
One score, clear severities, and the evidence behind each conclusion.
Example site: example.com
One critical finding is confirmed by evidence.
Findings by severity
- critical2
- high3
- medium5
- low4
- unknown1
Score by category
PHP runtime appears vulnerable to a published vulnerability
- Detected
- PHP 8.2.12
- Affected
- According to current vulnerability intelligence
- Fixed in
- Taken from the vendor advisory
Header: X-Powered-By: PHP/8.2.12
Captured 2026-10-22 23:00 UTC · confidence: Confirmed
Why runtime security matters
Your application can be fully up to date and still be exposed. The runtime, web server, TLS libraries and operating system sit below your code, and flaws there are not fixed by updating your dependencies.
PHP runtime vulnerabilities, such as the recent PHP2Shell pair, are an example: they are patched in the runtime itself.
Known vulnerability
A published CVE that matches software we detected, shown with the evidence and the fixed version from the advisory.
Security hardening recommendation
A best practice that lowers risk, such as a missing security header. It is never labeled a CVE.
Security guides and the latest vulnerabilities
PHP2Shell: CVE-2026-109618 and CVE-2026-109619
Affected versions, the fixed PHP releases, and how to check your site.
GuideHow to check a website's PHP version (and why it is often hidden)
Find out which PHP version a website runs, from the outside with headers and from the server with php -v, and why the version is often hidden.
GuideSSL/TLS certificate check: expiry, chain and hostname
How to check an SSL/TLS certificate: expiry date, hostname match, complete chain, signature and key size, and which TLS versions to disable.
All security guides · Vulnerability database · Website security for Canadian businesses
Container security
A website address cannot show what is inside your container. That is why there are two scan modes, and we never claim an image is vulnerable from a URL alone.
Website scan
Give us a public address. We run passive, outside-in checks.
Container image scan
Give us an image reference. We inspect OS packages, PHP, OpenSSL, CA certificates, libraries and dependencies, and count Critical, High, Medium, Low and Unknown.
24×7 Security & DevOps support
Found something? Our security and DevOps team can fix it with you.
- Vulnerability remediation
- Cloud security
- Container security
- Kubernetes security
- Azure/AWS security
- DevSecOps
- Infrastructure hardening
- Patch management
- Incident response
Frequently asked questions
Is it safe to scan my site?
Yes. Checks are passive: we read what any visitor can see, use ports 80 and 443 only, and never try to exploit anything.
Can I scan any website?
Only websites and infrastructure that you own or are authorized to assess. You confirm this before every scan.
Why does it say a version “could not be confirmed”?
Many servers hide their versions. We never guess: when evidence is missing we say so and suggest a container or image scan.
What is the difference between a hardening recommendation and a known vulnerability?
A hardening recommendation is a best practice, such as a missing header. A known vulnerability is a published CVE that matches software we detected.
Can you tell if my Docker image is vulnerable from my website address?
No. A public address cannot show what is inside a container. Scan the image itself to check OS packages, PHP, OpenSSL and libraries.
Does a clean report mean I am fully patched?
It means nothing was found in what we could verify remotely. Layers we cannot see are marked clearly in the report.
Can you check whether my site is affected by PHP2Shell?
We can check whether the PHP version your server announces is in the affected range for CVE-2026-109618 and CVE-2026-109619. If your server hides its version, the result is “could not be confirmed” and you should check with php -v or scan your container image.