What Am I Using?
English (UK)EN

What Am I Using?

Website security checker

Check public website settings or assess owner-supplied PHP package details against vendor advisories. Free checks, with clear evidence and next steps.

Public website checkCheck your PHP packageCheck OS updates

1. Check public website settings

One public page, checked on request. The address is sent to our server; page scripts are never run. How website checks use data.

Enter a public page without query parameters. Do not enter private, password-protected or confidential links.

3 fresh checks per network / dayAll report sections freeNo account needed

All three website checkers share one allowance, resetting at midnight UTC. Failed attempts can use a check. Shared networks share the allowance; cached reports do not use a fresh check. A site-wide limit also protects this free service.

For website owners

2. Check your PHP package

Match your distribution’s PHP package against vendor security advisories. No website address needed. Your entries stay in this tab.

PHP2Shell: check your PHP security patches

This PHP vulnerability checker compares your full installed package revision with vendor fixes for CVE-2026-109618 and CVE-2026-109619, alongside other published PHP advisories. Vendors can backport security patches without changing the headline PHP version, so a version such as PHP 7.4.3 alone cannot confirm whether a fix is installed. Use the package check below; it does not attempt an exploit.

Find your server and package details

Use a machine you own or administer. These commands read information; they do not install updates or change settings. Never enter a password, private SSH key or access token into WAIU.

Managed hosting, cPanel or Plesk

Open your hosting dashboard and select the website. Find its PHP settings or PHP handler to identify the version and whether it uses PHP-FPM or an Apache module. A dashboard often omits the full operating-system package revision.

If shell access is unavailable, ask your provider: “Which OS/release, PHP runtime version, full installed package revision and package repository serve this website? Does the running web process use that package, and have services restarted since the security update?”

Do not enable SSH or create a public phpinfo() page just for this check. Provider-managed, PPA, Remi, Homebrew and custom builds need that provider’s security evidence rather than the distribution package comparison.

Connect to your Linux server using SSH
  1. Find the server address, SSH username and access instructions in your hosting control panel. Ask your administrator if unsure.
  2. On Windows, open Windows Terminal or PowerShell. On macOS, open Terminal. On Linux, open your usual terminal.
  3. Replace the example username and hostname below. Use the port and SSH key method specified by your host. Do not share the key or password.
  4. Check the server fingerprint against your provider’s trusted record before accepting a first connection. If an existing fingerprint has changed unexpectedly, stop and check with the provider.
  5. Run the relevant read-only commands below. You normally do not need sudo or root access. Type exit when finished.

Connect using your hosting details

ssh your-user@your-server.example

If SSH is not available, use the provider’s browser console or ask support. A container has its own OS and package inventory; checking only its host can give the wrong answer.

Ubuntu or Debian: OS, PHP and full package revision

1. Read the operating-system name and release

cat /etc/os-release

Use ID and VERSION_ID, such as ubuntu and 20.04. Choose that distribution and PHP branch in the form.

2. Read command-line PHP as an initial clue

php -v

This is only a clue. The website may run a different PHP version. Check the website’s hosting settings or web-server/PHP-FPM configuration before confirming the runtime checkbox.

3. Example: inspect the PHP 7.4 FPM package

dpkg-query -W -f='${binary:Package} ${Version}\n' php7.4-fpm

Replace php7.4-fpm with the installed web package, for example php8.3-fpm or libapache2-mod-php8.3. “No packages found” means that package name is not installed; do not install it for this check. Copy the complete version after the package name, including any epoch, Ubuntu/Debian suffix and ESM revision.

4. Example: check the package’s listed repositories

apt-cache policy php7.4-fpm

Use your actual package name again. Confirm the installed version comes from the official repository for the selected distribution. A repository listing alone does not prove the origin of a manually installed package. Ubuntu Pro/ESM access and support entitlement also need to be valid.

AlmaLinux or Rocky Linux: package and PHP stream

1. Read the operating-system name and release

cat /etc/os-release

2. Read the installed PHP-FPM package with its epoch

rpm -q --qf '%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}\n' php-fpm

3. Read vendor and package information

rpm -qi php-fpm

For a different web handler, use the corresponding installed PHP package. Use the full version after the package name, including the epoch such as 0: and the complete module suffix. Match the selected PHP stream exactly. Ask the administrator to confirm the official repository and that this package serves the website. Remi or other third-party streams are outside this comparison.

Other Linux distributions or PHP on Windows/macOS

The OS update check is separate from PHP. Do not select a similar-looking Ubuntu, Debian or RPM package for another vendor. Use your host’s package/version information and that vendor’s security advisories. Unsupported combinations return “Unable to determine”. A visible PHP/7.4.3 header is not enough to establish backported fixes.

This report covers published advisories for the distribution/PHP combinations above, with newly added records included when the feed refreshes. Only the listed combinations are covered. Other distributions, third-party packages and WordPress plugins need their vendor’s assessment. Data older than 12 hours produces an inconclusive result.

PHP advisory data from the covered Linux vendors via OSV.dev. Ubuntu records by Canonical, retrieved via OSV.dev. The filtered advisory snapshot is adapted under CC BY-SA 4.0. Download the shared advisory snapshot.Data sources and licences.

For device and server owners

3. Check OS security updates

Compare a Windows Server build or macOS version with the vendor’s published updates. Your entries stay on your device. For Linux, use the package check above and your distribution’s security update tools.

Where do I find the version?

For a remote Windows Server, sign in using your provider’s approved console or existing Remote Desktop access. Do not enable remote access just for this check. Open Run (Windows + R), enter winver and copy the server release and full OS build, including the revision after the dot. In PowerShell, this read-only alternative shows the build and revision:
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object ProductName, CurrentBuild, UBR
Combine CurrentBuild and UBR with a dot. Choose standard cumulative updates only if that is how this server is maintained. On your Mac, or through an administrator-approved existing remote session, open Apple menu → About This Mac for the macOS version, then System Settings → General → Software Update to confirm what is offered to that Mac. In Terminal, sw_vers -productVersion prints the version. You do not need administrator rights for that command.

Linux updates are package-specific. Use your distribution’s security update tools and support information, plus the separate PHP package check above. An OS release number alone cannot establish the patch status of a Linux machine.

Release facts from Microsoft and Apple. Data older than 12 hours produces an inconclusive result. This checks supplied version information, not the device, running services or overall security.

What does this website security checker do?

It checks the final HTTPS connection, selected response headers, public software declarations and a bounded set of HTTP resource references and form actions. You receive the observed evidence and a suggested next step. It uses the same public response, cache and daily allowance as the Website Inspector and SEO scanner.

Does a good result mean a website is safe?

No. There is no overall safe score. HTTPS can be used by malicious sites, and a security header can be present but ineffective. A missing optional header is not automatically a vulnerability. We do not test logins, payments, malware, hidden paths, cookies or software exploits.

Can this check PHP or WordPress vulnerabilities?

A visible platform or version is a clue, not proof of patch status. A vendor can backport a fix without changing the public version, and a proxy can change a banner. Use the owner-supplied PHP assessment above to compare the listed Ubuntu, Debian, AlmaLinux and Rocky Linux PHP packages with their vendor advisories. It recognises vendor backports and reports other published PHP advisories as well as current issues. Third-party PHP builds and WordPress plugins need their own vendor checks. The separate OS section compares Windows Server builds and macOS versions with vendor release records. No exploit request is sent by this tool.

How do I use the recommendations?

Start with the intended behaviour of the page. Check HTTPS coverage, review the policy and test a change in staging. Confirm that forms, media and required integrations still work. Read our security-check interpretation guide for a practical sequence and technical references.

What if the page is incomplete or blocked?

Findings describe the response the checker received, which may be an error or bot challenge. An incomplete HTML read cannot prove that a resource reference is absent. A failed TLS connection stops the check; we do not bypass certificate validation.

Will this crawl the whole website?

No. The checker reads one public page and its crawl instructions. It does not follow asset links, submit forms, run scripts or keep monitoring. Query strings, private addresses and credentials are rejected. Cached snapshots retain their check time; all website checkers share the same limited allowance.

Keep this tool handy

Your browser saves the bookmark. This site cannot add it automatically.