Immense DesignsCheck My Site
Free Website Check

Is your website being looked after?

Ten seconds to see what your site runs on, who hosts it, and what needs attention, including this week's PHP2Shell flaw.

What's it built on? (optional)

10 seconds · 8 checks · Free, no sign-up

Looks only at what any visitor can see. We keep a record of sites checked and never contact anyone from it.

PHP2Shell

PHP2Shell, in plain terms.

What happened

On October 21, PHP fixed two serious flaws. PHP runs behind most small business sites, including every WordPress site.

What's at risk

An attacker could take over the server with no password. That reaches your site, form messages and stored passwords.

What fixes it

A PHP update on the server, usually your host's job. Updating WordPress or switching themes won't fix it.

Where the big hosts stand

From each host's own announcement. Updated Oct 22.
WP EnginePatchedFlywheelPatchedKinstaPatchedSiteGroundPatchedWordPress.com or PressableRolling outGoDaddyPatchedBluehostRolling outHostGatorRolling outDreamHostPatchedHostingerPatchedNamecheapPatchedhosting.com (formerly A2 Hosting)Rolling outInMotion HostingRolling outCloudwaysPatched

Many hosts apply the fix without changing the PHP version number. Builders like Squarespace and Wix aren't affected.

Think you've been hacked?

  • Leave the files alone, so there's a trail to clean up.
  • Tell your hosting company today.
  • Change your hosting, website and email passwords.

Then run the check and ask for a free review.

What your web person should handle

  • Monthly updates, with a backup first
  • PHP on version 8.3 or newer
  • Backups kept off the website's server
  • Watching for downtime and hacks
  • Domain and certificate renewals
  • Accounts in your name, with your login

Questions.

Is it safe to run this on my site?

Yes. It reads the same public pages any visitor sees, with a handful of normal requests. It doesn't log in or try to break anything.

Does a clean result mean my site is secure?

It means we didn't see a problem from the outside, which is good news. No outside check can promise more than that.

Should I move to Squarespace, Wix or Shopify?

Those platforms aren't affected, but switching means rebuilding your site from scratch. You almost never need to. Keep your site and make sure someone keeps it updated.

What do you do with the website I enter?

We keep a record of sites checked to improve the tool, and we never contact anyone from it. An email address used to send a report isn't saved.

This check looks at public information only and can't guarantee a website is secure. PHP2Shell is tracked as CVE-2026-109618 and CVE-2026-109619.