Automated Security Assessment

How it works

1. Prove ownership. Add a one-line DNS TXT record or a small file to your site. No proof, no probing — ever.
2. Approve the plan. We profile your site and generate an exact test plan from a fixed check catalog. The plan is hash-bound: if it changes, your approval no longer counts.
3. We run it. Throttled probes (starting under 2 requests/second, latency-adaptive), every request written to a hash-chained audit ledger. DNS is re-verified during the run; if it changes, the run halts.
4. Findings are verified. Positives are independently re-tested. CONFIRMED means directly observed and reproduced — version-based findings are honestly capped at POSSIBLY VULNERABLE.
5. You get the fix pack. A work-report PDF plus ready-to-apply Nginx/Apache rules and PHP hardening for each finding. Nothing is ever applied to your server by us.

Start an assessment job (sign-in required)

What it checks — the full catalog

Every check in the fixed catalog (v1.0) — the same list your test plan is generated from. Nothing is added at run time.

• Exposed phpinfo page — Checks the well-known paths for a publicly reachable phpinfo page, which discloses the full PHP configuration, exact version and server paths to anyone. (max verdict confirmed)
• Sensitive files exposed — Requests paths such as /.env and the Composer files to see whether sensitive files are served to anyone who asks. (max verdict confirmed)
• PHP version vs CVE floors — Compares the PHP version your site discloses with the fixed releases for known CVEs. Version evidence only — never an exploit probe — so findings are capped at POSSIBLY VULNERABLE. (max verdict possibly vulnerable)
• Baseline security headers — Checks the homepage response for the baseline hardening headers: Content-Security-Policy, X-Content-Type-Options, frame protection, Referrer-Policy and, on HTTPS, Strict-Transport-Security. (max verdict confirmed)
• Cookie security flags — Checks the cookies the homepage sets for the HttpOnly, Secure and SameSite flags. Only cookie names and missing flags are recorded — never values. (max verdict confirmed)
• TLS configuration — Completes a TLS handshake to check for obsolete protocol versions (TLS 1.0 / 1.1) and a certificate that does not validate; a plain-HTTP site is flagged outright. (max verdict confirmed)
• Directory listing — Requests common directories (/uploads/, /images/, /backup/, /assets/) to see whether an autoindex listing exposes file names to anyone. (max verdict confirmed)
• PHP error disclosure — Requests a missing page and a malformed parameter and looks for raw PHP error output leaking internal paths and code details. (max verdict confirmed)
• Unencoded input reflection — Adds an inert random token as a query parameter and checks whether it comes back unencoded in the response — the mechanism behind reflected XSS. The token is plain text, never a script payload. (max verdict confirmed)
• HTTP methods (TRACE) — Asks which HTTP methods the server advertises and, if TRACE is among them, sends one TRACE request carrying a canary header to see whether it is echoed back — the cross-site tracing precondition. (max verdict confirmed)
• CORS misconfiguration — Sends a request with a foreign Origin header and checks whether the response would let other sites make credentialed cross-origin reads of authenticated pages. (max verdict confirmed)
• Version banner disclosure — Reads the Server and X-Powered-By response headers for exact software versions, which attackers use to match exploits to your stack. (max verdict confirmed)
• Session upload-progress preconditions — Sends one inert multipart upload — a plain-text canary file that PHP discards when the request ends — and checks whether the php2shell upload-progress preconditions are present: an affected PHP version and PHP sessions in use. Whether the setting itself is on can only be read by the deep check. (max verdict possibly vulnerable)

What it never does

• No exploit payloads — verification uses inert canary tokens and direct observation only. The php2shell exploit trigger is never sent, to anyone, ever.
• No changes to your site: no uploads that persist, no database writes, no shell attempts.
• No probing without verified ownership and an approved plan.
• It is an automated assessment, not a human penetration test: business-logic flaws and chained exploits are out of scope, and we say so in every report.

Not a compliance penetration test

This product is an automated assessment: the fixed catalog above, run by software. It is not a human penetration test, and it does not by itself satisfy compliance penetration-testing requirements. PCI DSS, for example, requires penetration testing — and whether an automated scan counts toward that requirement is your assessor's decision, not ours. If you need a compliance penetration test, engage a qualified human tester; run this first to clear the common exposures they would find anyway.

Assessment plans

These are the Assessment plans — separate from the Patch plans ($299/$399 per year) on the home page. Checkout opens with Stripe shortly; requesting a plan reserves it at this price and nothing is charged now.

Signed-in customers request Pro / Fleet Guard from the Plans section of their account. Branch Migration is scoped per engagement — open a follow-up from your account and we will quote it.