Is the website security check really free?

Yes. You get your score and grade straight away and by email. If you would like the issues fixed, our Security fix package is a fixed price agreed before any work starts.

Why don’t you show me what you found?

Publishing a website’s security weaknesses on a results page, or in an email that can be forwarded, would make them easier to exploit. We show your score and how many issues of each size we found, then go through the specifics with you privately.

Does the scan check for PHP errors and PHP vulnerabilities like php2shell?

Yes. It checks whether your server announces a PHP version open to php2shell (CVE-2026-109618 and CVE-2026-109619) or one that no longer gets security fixes, and whether PHP error messages are being shown to visitors on your home page.

Will the scan harm or slow down my website?

No. It is passive: it visits your home page once, the way a browser does, and reads your public DNS records. It never tries to log in, never guesses at hidden files and never sends attack code.

Can I scan someone else’s website?

Only with their permission. You must confirm you own the site or have permission to scan it, and the results go to the email address you give and to us.

What does the check look at?

Encryption and certificate, Security headers, Cookies, PHP version, php2shell and error messages, WordPress / CMS version, Outdated scripts and mixed content, Email spoofing protection (SPF, DKIM, DMARC).

What happens after I scan?

You see your score immediately and get it by email. Matt from T19 Digital will be in touch to talk you through what we found and what fixing it involves. There is no obligation.

Do you add me to a mailing list?

Only if you tick the newsletter box, and even then you confirm by email first. One email a month, unsubscribe in one click.

Free · passive · about 30 seconds

Free website security check.

Find out how exposed your website is, including PHP versions open to php2shell, PHP error messages, WordPress flaws like wp2shell, missing security headers and email spoofing gaps. You get a score straight away and by email. The details we keep private and go through with you.

What the security check looks at

PHP, php2shell and PHP errors

Whether your PHP version is open to php2shell (CVE-2026-109618 and CVE-2026-109619) or no longer gets security fixes, and whether PHP warnings or fatal errors are being printed to your visitors, giving away file paths and internals.

WordPress and wp2shell

Which WordPress version your site shows, compared against the July 2026 wp2shell fixes and other long-outdated releases, plus old JavaScript libraries with known flaws.

HTTPS and certificate

Whether plain http redirects to https, whether your certificate is valid and in date, and whether anything on the page still loads insecurely.

Security headers and cookies

HSTS, Content-Security-Policy, clickjacking protection, and the flags on any cookies your home page sets.

Email spoofing protection

Your SPF, DKIM and DMARC records, which decide whether someone else can send email that looks like it came from you.

What it never does

It never tries passwords, never hunts for hidden files and never sends attack code. That would be illegal without proof of ownership, and a tickbox is not proof. Deeper testing comes with the Security fix, once ownership is confirmed.

Why we don’t show the findings on screen

Anyone can type any address into a tool like this. If we printed exactly what was wrong, we would be publishing a to-do list for whoever wanted to break in. So you get your score, your grade and how many serious, medium and minor issues there are. The specifics go to you privately, in a conversation, along with what it takes to fix them.

The package

Security fix

We go through every finding with you, fix them in priority order, and re-scan to prove it. We update or replace what is out of date, move PHP to a supported version, switch off error display, add the missing headers, set up SPF, DKIM and DMARC, and hand you a short written report of what changed. If you want it kept that way, a care plan takes over from there.

Fixed price, agreed before any work starts · usually done within a week

Get your score first Talk to us about it

Security guides

Questions people ask

Is the website security check really free?: Yes. You get your score and grade straight away and by email. If you would like the issues fixed, our Security fix package is a fixed price agreed before any work starts.
Why don’t you show me what you found?: Publishing a website’s security weaknesses on a results page, or in an email that can be forwarded, would make them easier to exploit. We show your score and how many issues of each size we found, then go through the specifics with you privately.
Does the scan check for PHP errors and PHP vulnerabilities like php2shell?: Yes. It checks whether your server announces a PHP version open to php2shell (CVE-2026-109618 and CVE-2026-109619) or one that no longer gets security fixes, and whether PHP error messages are being shown to visitors on your home page.
Will the scan harm or slow down my website?: No. It is passive: it visits your home page once, the way a browser does, and reads your public DNS records. It never tries to log in, never guesses at hidden files and never sends attack code.
Can I scan someone else’s website?: Only with their permission. You must confirm you own the site or have permission to scan it, and the results go to the email address you give and to us.
What does the check look at?: Encryption and certificate, Security headers, Cookies, PHP version, php2shell and error messages, WordPress / CMS version, Outdated scripts and mixed content, Email spoofing protection (SPF, DKIM, DMARC).
What happens after I scan?: You see your score immediately and get it by email. Matt from T19 Digital will be in touch to talk you through what we found and what fixing it involves. There is no obligation.
Do you add me to a mailing list?: Only if you tick the newsletter box, and even then you confirm by email first. One email a month, unsubscribe in one click.