NSA urges teams to update PHP
The NSA recommends finding sites that use PHP and applying recommended updates.
NSA / CSS · OCT 21 OPEN STORY ↗ A clear first step for PHP website owners
Protect your site.
Know what to fix.
Check your website for visible security issues. Get a clear report your developer can act on.
DETAILED REPORT · TARGET: UNDER 5 MINUTES AFTER PAYMENT
A CLEARER VIEW OF WHAT NEEDS ATTENTIONCustomer feedback
01 — START HERE
Start with a free
website check.
We’ll check whether your site responds and show a few visible eligibility signals. This first look has no score and does not start the paid scan. No payment details needed.
Free eligibility check
Enter your website address to check whether a detailed assessment is available.
No website checked yet
- Website address validated
- Checking public website response
- Confirming report availability
- Website responds
- Eligible for a detailed assessment
- Up to 100 public pages; the report lists pages actually checked
- PDF report delivered to your email after payment
FIELD NOTES — WHY THIS MATTERS
Security warnings
are making headlines.
Official patch guidance and independent reporting describe the response to recent PHP flaws. Those reports do not show whether your site is affected. Check what is visible, then ask your developer to verify the server.
Coverage of the patching response
AP reports on the rush to fix the PHP security flaws.
ASSOCIATED PRESS · UPDATED OCT 22 OPEN STORY ↗
AI research brings a PHP flaw to light
Axios covers software security research and the response to the disclosure.
AXIOS · OCT 21 OPEN STORY ↗
BBC NewsREPORTING · OCT 21UK working to identify exposure after global cyber-security warning
Open story
The GuardianREPORTING · OCT 22Websites across world hit by millions of attempts to exploit PHP code flaw
Open story
BloombergREPORTING · OCT 22How AI Unearthed PHP Software Flaws That Put Millions of Websites at Risk
Open story
WIREDREPORTING · OCT 21‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
Open story
ReutersREPORTING · OCT 23Hacking attempts surge as companies, governments rush to patch PHP flaws
Open story
The New York TimesEXPLAINER · OCT 22What Is PHP? Why Are Government and Business Websites Going Offline?
Open storyIndependent reporting and official guidance about PHP. These organizations do not endorse or certify PHP Site Audit.
02 — HOW IT WORKS
From website check
to developer checklist.
Start free. Before any paid scan, review the proposed scope and confirm you have permission. The report separates observed results from checks that remain unknown.
How the check works01
Check your website
See whether the site responds and review a few visible eligibility signals. No score or paid scan yet.
02
Review the scope
See the proposed checks, enter your email, confirm owner permission and choose whether to continue.
03
Share clear next steps
Get a private report showing passes, items to review, unknowns and verification steps for your developer.
03 — WHAT TO EXPECT
Clear findings.
Practical next steps.
Your private report shows what passed, what needs review and what remains unknown. It includes observed pages and practical follow-up for your developer.
PHP release guidance recommends applying current updates. A public website check cannot confirm the PHP version or patch state running on your server.
See current PHP release guidanceSee exactly what we check
Warning signs we can see
A bounded review of up to 100 public same-host HTML pages and selected HTTP/TLS settings. The report lists pages and checks actually observed.
A developer handoff
Plain explanations, observed evidence and suggested steps to verify with your developer or hosting provider.
Some answers need your host or developer
A public scan cannot confirm the PHP runtime, vendor backports, private routes or a compromise. It makes no changes and uses no exploit attempts. Ask your host or developer to verify patch state and apply any needed fixes.
ONE WEBSITE — ONE CLEAR PRICE
Know what you’ll get
before you pay.
PHP WEBSITE SECURITY AUDITONE TIME
$19.99USD
An automated review of up to 100 public pages, with observed results and practical developer follow-up.
Check my site now One-time payment · Target: report in under 5 minutes after payment. Review scope before checkout.QUESTIONS — ANSWERED
Before you
get started.
What does the free website check do?＋
It checks whether your website responds and gathers a few visible clues. It does not run the paid review, produce a score, or tell you whether your site has been compromised.
Do I need permission?＋
Yes. You must own the website or have the owner’s permission. You’ll confirm this before checkout, and we only check the website shown in your scope.
Will this disrupt my website?＋
The review uses bounded public-page requests and makes no changes. No scan can promise zero impact. You’ll see the proposed scope before deciding whether to continue.
Can this confirm whether my site is hacked or PHP is patched?＋
No. An external review cannot confirm a compromise, the serving PHP runtime, or vendor backports. It reports visible signals and practical checks for your developer or hosting provider to verify.
Does this find every problem or fix my site?＋
No. Some problems can only be checked by your host or developer, and this scan does not change or repair your website. It is not a full security test or a guarantee that your site is safe.
How do I get my report?＋
After the check is complete, we’ll provide a private report link. Keep it private and share it only with people you trust.
START WITH ONE DOMAIN