This is: A fixed-price, one-time assessment of one website or PHP environment, with a written report you can hand to your developer.
This is not:
- A penetration test
- A WordPress plugin or theme vulnerability scan
- Continuous monitoring of your site
PHP Exposure Assessment
Know Exactly Where Your PHP Stands
A clear, written answer for one website or PHP environment: which PHP version you run, which settings need changing, which published advisories apply, and what to fix first.
$499one-time, for one website or PHP environment
Bought and run from your Scan Ninja dashboard
Unauthenticated by default
Optional read-only SSH
Actively exploited issues first
Written PDF report
Every PHP Site Runs on a Support Clock
Websites keep serving traffic long after their PHP version stops receiving security fixes. That is when known vulnerabilities start to pile up with no upstream patch.
PHP 8.1
Reached end of life on December 31, 2025. Newly found vulnerabilities in 8.1 are no longer fixed upstream.
PHP 8.2
Security support ends on December 31, 2026. After that date, 8.2 joins 8.1 without upstream security fixes.
PHP 8.5
The current PHP release, and the version to plan an upgrade toward if you are on 8.2 or older.
Dates from php.net supported versions and end-of-life pages, checked October 21, 2026.
What You Get
- PHP version and configuration inventory
- Review against applicable security advisories
- Prioritized findings and remediation recommendations
- Written assessment report (PDF)
What We Check
Version and configuration
Fingerprints the PHP version, web server and CMS or framework (WordPress, Drupal, Joomla, Laravel, Symfony). Checks 22 php.ini security settings and gives the exact fix line for each one that needs changing. Reviews session cookie flags.
Exposed files
Looks for files that commonly leak information or secrets, such as phpinfo pages, .env files, .git directories and backups. Matches are confirmed by content signature, not just by a response code.
Security advisories
Checks the PHP runtime and CMS core against NVD, prioritized with CISA KEV and EPSS, and Composer packages against OSV. Actively exploited issues are ranked first.
End-of-life status
Reports whether your PHP version and your CMS version are still supported, past end of life or approaching it, so you know how urgent an upgrade is.
What Happens After You Sign Up
1
Create your account
Sign up for Scan Ninja to get your dashboard.
2
Buy the assessment
On the Plans page, choose One-time services and buy the PHP Exposure Assessment.
3
Launch it from the scanner
Enter your website URL. Optionally select a read-only SSH credential for the server-side review.
4
Download your report
When the assessment completes, download the written report from your dashboard.
Unauthenticated or Credentialed
The assessment runs without any access to your server. Add a read-only SSH credential and it goes deeper.
Unauthenticated (default)
Works from the outside, like any visitor to your site.
- PHP version, web server and CMS or framework fingerprinting
- Commonly exposed files (phpinfo, .env, .git, backups) confirmed by content signature
- Session cookie flags
- PHP and CMS end-of-life status
- Advisories for the PHP runtime and CMS core
With read-only SSH (optional)
Uses a credential you register in your dashboard.
- Everything in the unauthenticated assessment
- Direct review of php.ini and php-fpm settings on the server
- composer.lock collection for Composer package advisories
- WordPress version collected from the server
Sample Report Outline
The written report follows what was checked, so your developer can work through it top to bottom.
- Executive summary
- Scope and methodology, including what could not be checked
- Environment inventory: PHP version and support status, server, CMS or framework, Composer packages, exposed files
- Configuration review: current value, recommended value and status for each setting
- Advisory review: known vulnerabilities with severity scores, exploit likelihood and actively exploited status
- Prioritized findings with remediation for each
- Remediation roadmap: immediate, short term and planned
- Appendix: all findings
Frequently Asked Questions
Your website URL. That is enough for the default, unauthenticated assessment. If you want the deeper server-side review, you can also register a read-only SSH credential in your Scan Ninja dashboard and select it when you launch the assessment.
No. By default the assessment works from the outside, the same way any visitor reaches your site. Read-only SSH access is optional. It adds a direct review of php.ini and php-fpm settings and collects composer.lock and the WordPress version from the server.
We inventory plugins and themes, so you can see what is installed. Plugin and theme vulnerability lookups are not part of the assessment today. Advisory checks cover the PHP runtime, CMS core (including WordPress core) and Composer packages.
No. The assessment fingerprints versions, checks for commonly exposed files by content signature, reviews configuration and matches what it finds against published security advisories. It does not attempt to exploit anything. If you need a penetration test, see our penetration testing page or talk to us.
The PHP runtime and CMS core are checked against the National Vulnerability Database (NVD), prioritized with the CISA Known Exploited Vulnerabilities catalog and EPSS scores. Composer packages are checked against OSV. Findings that are known to be actively exploited are ranked first.
Each assessment covers a single website URL, plus the server behind it when you add read-only SSH access. If you have several sites, talk to us about the best way to cover them.
Yes. The report states the scope and the coverage limits of the assessment. For example, an unauthenticated assessment cannot read php.ini directly, and a server that hides its PHP version limits what can be fingerprinted. Those limits are written down rather than glossed over.