Find security holes in your PHP code before attackers do
A free static self-check for small site owners and freelance PHP developers. Upload a zip or paste a file — get SQL injection, XSS, upload and dangerous-function findings with fixes in under a minute.
We never scan live websites. Your code is analysed in a temporary folder and deleted as soon as the scan finishes. Privacy
Try the free dependency & PHP version checkCode scanning is coming soon; the composer.lock and PHP version (incl. PHP2Shell patch) check is free and live now.
SQL injection & XSS
Follows request data ($_GET, $_POST, cookies) into queries and output, including escaped values used unquoted in SQL.
Dangerous functions
eval, exec, system, shell_exec, passthru, unserialize, assert, preg_replace /e — ranked higher when user input reaches them.
Insecure file uploads
Spots move_uploaded_file() with client-chosen names and no extension whitelist.
Dependencies
Reads composer.lock and checks every package against the OSV database and FriendsOfPHP advisories.
Backport-aware PHP check
Ubuntu and Debian patch PHP without changing the upstream version. Enter your package version and we check the distro’s own security tracker — no false “outdated PHP” alarms.
Fix advice + PDF
Every finding has file, line, severity and a concrete fix. Download a PDF report for your client.
Coming soon — get notified
The PHP scanner is not open yet. We are finishing the scanner service and will open free self-checks shortly.
Email me when it launchesFAQ
Is this a penetration test?
No. It is static analysis of the code you upload. It can miss issues and report some false positives; treat it as a first pass.
Why does my “old” PHP version show as patched?
Linux distributions backport security fixes, so a distro PHP package can contain fixes released upstream in later versions. We compare against the distro’s fixed package version instead of the upstream number.
How much does it cost?
Free: 1 scan per month, up to 50 PHP files, full finding counts plus details for the top 3 issues; dependency vulnerability details are always free. A single full report is $9 one-time, and Pro is $19/month. Paid plans are not live yet.
Do you keep my code?
No. Code is deleted right after the scan. Only anonymous monthly scan counters are stored.