Website and PHP security guides
Plain-language, practical guides on runtime, TLS, headers and container security, written for developers and the people who run their servers.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): affected versions and fixes
What is affected, which PHP releases contain the fix, and how to check your site.
How to check a website's PHP version (and why it is often hidden)
Find out which PHP version a website runs, from the outside with headers and from the server with php -v, and why the version is often hidden.
SSL/TLS certificate check: expiry, chain and hostname
How to check an SSL/TLS certificate: expiry date, hostname match, complete chain, signature and key size, and which TLS versions to disable.
HTTP security headers checklist: HSTS, CSP and more
A practical checklist of HTTP security headers (HSTS, CSP, nosniff, frame-ancestors, Referrer-Policy, Permissions-Policy) with ready-to-use values.
Vulnerability vs security hardening: what is the difference?
A known vulnerability is a published CVE that affects software you run. Hardening is a best practice. Learn why the difference matters for patching.
How to scan a Docker image for vulnerabilities
Scan a Docker image for OS, PHP, OpenSSL and dependency vulnerabilities with Trivy, read the results, and fix them by rebuilding on a patched base image.
How to update PHP on Ubuntu, Debian and RHEL safely
Step-by-step PHP security updates on Ubuntu, Debian and Red Hat family systems: check the version, upgrade, restart PHP-FPM or Apache, and verify.