Ecommerce Secure

PHP vulnerability scanner for your online store

Enter your store's URL and find out in seconds whether your PHP version, HTTP headers or public paths expose you to recent flaws like php2shell. You get 5 prioritized findings and how to fix each one.

https://

Passive and safe: reads only public headers and pages. No exploits, no sign-up.

Coverage

What the PHP security scanner checks

Five checks built for online stores running on PHP. Each one ends in a finding with its risk level and the concrete action to fix it.

Process

How to check your store's security in 3 steps

  1. Paste your store URL

    Type your domain, with or without https://. No account or install needed.

  2. Passive read in seconds

    The scanner only looks at what any browser sees: headers, cookies and public pages. It never sends attacks.

  3. Report with fixes

    You get a security score from 1 to 100 and 5 findings ranked by priority, each with the step to fix it.

Help

PHP security FAQ

What is php2shell (CVE-2026-109618 and CVE-2026-109619)?

It is the name given to two PHP vulnerabilities disclosed on October 21, 2026 that can allow unauthenticated remote code execution. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Branches 8.1 and earlier no longer receive official patches.

Is it safe to scan my online store?

Yes. Ecommerce Secure runs a passive analysis: it only reads HTTP headers and public pages, just like a browser. It sends no exploits, tries no passwords and changes nothing on your server. Use it only on sites you manage.

How do I find out which PHP version my site runs?

The scanner detects it if your server advertises it in the X-Powered-By header or other public signals. To confirm, run php -v on the server or check your hosting control panel.

Does it work with WooCommerce, Magento, PrestaShop and Shopify?

Yes. It identifies WooCommerce, Magento and PrestaShop, which run on PHP and are exposed to these vulnerabilities. If your store runs on Shopify, the report confirms you do not run your own PHP and that these CVEs do not affect you.

How do I hide my server's PHP version?

Set expose_php = Off in php.ini and restart PHP-FPM or Apache. That removes the X-Powered-By header. Hiding it is no substitute for upgrading: installing the patched version is what closes the risk.

Does this scan replace a security audit?

No. It is a quick, free check based on public signals. For a complete assessment you need a professional audit or penetration test and a direct review of versions on the server.

Scan my store now