HOW WE WORK

Evidence first.
Clear boundaries.

An automated external assessment, with a practical developer handoff.

Before you pay

We validate the submitted domain and perform a limited public lookup. We show whether the site is reachable, visible technology signals, the proposed checks and limitations. This lookup is not a vulnerability scan or security score.

The paid assessment

After confirmed payment, we start from the supplied website and use public same-host links plus robots.txt or same-host sitemap files as discovery hints. The crawler attempts up to 100 unique public same-host HTML pages. A shared limit of 140 HTTP requests covers page fetches, redirects and discovery, with a 90-second scan budget. The report lists the paths and checks actually completed; fewer pages may be checked if the site blocks requests, has few discoverable links, or reaches a request or time limit. We check public HTTP and HTTPS responses, certificate validation, redirects, browser security headers, visible cookie attributes and technology disclosures. We do not attempt remote code execution, password guessing, exploitation or changes to your site.

What the score means

The external hygiene score summarizes the applicable, completed controls in this report. Each scored control has equal weight: a pass earns one point and a fail earns zero, expressed on a 0–100 scale. Unknown and inapplicable checks and technology banners are excluded. We withhold the score when fewer than three applicable controls complete. Coverage and unknown results are shown alongside it. This is not a probability of compromise, compliance certification or a comprehensive measure of website security. PHP runtime patch status is separate; a good header score does not demonstrate that PHP is patched.

PHP2Shell and vendor backports

A banner is an observation, not proof of the installed runtime or its patch set. Vendor packages may contain backported security fixes. Hidden versions, multiple runtimes, CDNs and hosting configuration can prevent remote verification. We cite PHP guidance and ask for hosting or runtime evidence where needed.

Developer instructions

Each finding includes the observed evidence, its confidence and significance, recommended action and a verification step. Advice that depends on your hosting stack is conditional. Test changes in staging, keep backups and follow your host's instructions.

What is outside scope

Private source code, databases, authenticated routes, a complete plugin inventory, business logic, access control, malware forensics and comprehensive SQL injection or cross-site scripting testing are outside this assessment. A report with no detected issues cannot establish that a site is safe.

Independent sources

Government alerts, PHP advisories and news coverage explain the wider issue. They are not endorsements of Synorb Inc. or PHP Site Audit.