PHP Source-Code Analysis
Upload a ZIP of your PHP project for heuristic static analysis. Source files are read in memory and are never executed. Reports include severity, evidence, and remediation guidance.
Limitations: PHP analysis uses heuristic patterns, not full data-flow analysis. Findings may be false positives or false negatives. Only scan websites and code you own or are authorized to assess.
OWASP WSTG relationship
Complementary source reviewThe WSTG primarily describes testing a running web application. PHPGuard's PHP source analyzer is a separate heuristic source-code review that can help prioritize manual testing; it does not establish WSTG test completion.
Source analysis is heuristic and not a substitute for data-flow analysis, dependency scanning, framework-aware review, or runtime testing. Read the official OWASP WSTG.
PHP Source-Code Analysis
Static analysis · no code executionUpload a ZIP containing your PHP project. PHPGuard reads eligible source files in memory and does not extract or execute the archive. Maximum ZIP size 5 MB; up to 250 entries; individual PHP files up to 256 KB; total scanned source up to 3 MB.
Upload a ZIP containing your PHP project to generate a source analysis report.
Frequently Asked Questions
Is PHPGuard free?
Yes. The checker is free to use, and scan reports can be exported to CSV or JSON.
Can this tool find every vulnerability?
No. Website checks do not prove SQL injection or XSS, test authentication/access control, business logic, or validate CVEs. PHP source scanning is heuristic pattern matching and does not execute code or perform full taint analysis. It is a triage tool, not a penetration test or proof of security.
Is PHP source code executed or extracted?
No. PHPGuard reads eligible PHP files from the uploaded ZIP in memory. It does not extract or execute the archive. Upload source code only when you are authorized to share and analyze it.
Why are some findings marked as informational?
Informational checks describe observed configuration and do not necessarily indicate a vulnerability. Review each result in the context of your application.