Website URL Security Scan

Scan a public website for observable security configuration and low-impact exposure signals. Reports include severity, evidence, and remediation guidance.

Limitations: Website checks are unauthenticated and limited in scope. Findings may be false positives or false negatives. Only scan websites and code you own or are authorized to assess.

What does PHPGuard do?

A developer-focused security assessment tool

PHPGuard helps website owners and developers identify common security configuration concerns on a public website and potential risky patterns in PHP source code. It offers two separate scan modes so you can check a running website or review PHP code without executing it.

Website URL scanChecks observable items such as HTTPS use, selected security headers, cookie security attributes, response information, and selected low-impact exposure paths when explicitly authorized.

PHP source-code analysisReviews an uploaded PHP project ZIP for suspicious patterns such as risky dynamic execution, shell commands, possible SQL construction, unsafe includes, weak randomness, and potentially unescaped output. Source files are read in memory, not executed.

Actionable reportsShows findings with severity, evidence or source line references, related OWASP WSTG areas, verification status, and remediation guidance where available. Results can be exported for follow-up.

What it is notPHPGuard is not a full penetration test and cannot guarantee a website is secure. Findings need verification, and the current OWASP WSTG coverage is partial.

OWASP WSTG-aligned coverage

Selected checks · partial coverage

WSTG 4.1 · Information GatheringHTTP status, page metadata and limited technology disclosure.

WSTG 4.2 · Configuration & DeploymentSelected security headers and a fixed set of low-impact exposure checks.

WSTG 4.6 · Session ManagementCookie attributes observed on the requested unauthenticated page only.

WSTG 4.9 · Weak CryptographyHTTPS transport indicator only; not a full TLS/cipher audit.

Not yet covered: authentication, authorization, authenticated session workflows, injection validation, business logic, comprehensive API testing, and CVE verification. This is partial alignment, not OWASP certification. Read the official OWASP WSTG.

Website URL

Enter example.com, www.example.com, or a full URL with http:// or https://. If you omit the protocol, PHPGuard will try HTTPS by default.

Enable carefully controlled active checks

Send a small set of fixed, low-impact requests to check for common exposed files and inspect supported HTTP methods.

No exploit payloads, login attempts, form submissions, destructive actions, or redirect following.

Only public hosts on ports 80/443 are accepted. Private/reserved IPs are blocked, DNS is resolved and pinned per scan, redirects are not followed, requests/timeouts are bounded, and scans are rate-limited per session. Scan only systems you are authorized to test.

Ready to check a website

Enter a URL above and start a scan to generate your report.

Frequently Asked Questions

Is PHPGuard free?

Yes. The checker is free to use, and scan reports can be exported to CSV or JSON.

What do active checks do?

If selected and explicitly authorized, PHPGuard sends a small fixed list of GET requests for common exposure paths and one OPTIONS request. It does not submit forms, send exploit payloads, attempt logins, follow redirects, or intentionally modify data.

Can this tool find every vulnerability?

No. Website checks do not prove SQL injection or XSS, test authentication/access control, business logic, or validate CVEs. PHP source scanning is heuristic pattern matching and does not execute code or perform full taint analysis. It is a triage tool, not a penetration test or proof of security.

Why are some findings marked as informational?

Informational checks describe observed configuration and do not necessarily indicate a vulnerability. Review each result in the context of your application.

Can I scan any URL?

Only scan sites you own or are authorized to assess. The tool restricts destinations to public hosts and standard web ports, and does not follow redirects.