SystemNexa
Home
Solutions
Expertise
Industries
Work
BlogsCompanyContact
Cost calculatorStart a conversation
SystemNexa

Web platforms, custom software, automation and infrastructure for organisations that need the system to keep working after launch.

Services

  • AI Voice Agents
  • Custom Web Applications
  • Managed Application Services
  • Software Testing & QA
  • AI Workflow Automation
  • SaaS Modernisation
  • All services

Solutions

  • Engineering
  • AI & Automation
  • Infrastructure
  • Growth
  • All solutions

Free tools

  • Website Security Check
  • Web App Cost Calculator
  • Missed Call Cost Calculator
  • Booking Fee Calculator

Company

  • About SystemNexa
  • Selected work
  • Industries
  • Expertise
  • Blogs
  • Contact

Contact

  • Email

    [email protected]

  • WhatsApp

    +1 (727) 456-9863

  • Enquiries

    Contact form→
  • Remote first, based in Pakistan, working with clients in the UK and internationally.

Privacy

We process enquiry details to respond to your request and operate our services. See our Privacy Policy for how data is handled. Read the Privacy Policy.

Legal

  • Privacy Policy
  • Terms of Use

© 2026 SystemNexa. All rights reserved.

We turn enquiries, bookings and payments into systems your team can actually run.

WhatsApp
  1. Home
  2. /Website security check

Free tool

Is your website vulnerable?

Check your site for the PHP2Shell flaws, outdated WordPress, SSL problems and missing security headers. It takes about ten seconds, and every finding comes with a plain-English fix.

Version data checked 6 November 2026 against official PHP and WordPress releases

Happening now

PHP2Shell is being actively exploited. It is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released 21 October 2026). Separately, WordPress 7.1.4 (28 October 2026) fixes an upgrade-process flaw that can lead to remote code execution. If your site runs PHP or WordPress, check it below.

We load your public homepage once, like a browser would. Nothing is stored and we never log in or test for weaknesses.

What we check

Six checks, all from the outside

The same things an attacker can see in a few seconds, so you can fix them first.

PHP version
Whether your site reveals a PHP version affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), or one that no longer gets security updates.
WordPress version
Whether your WordPress core is older than 7.1.4, which fixes a weakness in the upgrade process that can lead to remote code execution.
SSL certificate
Whether your certificate is valid, and how many days it has left.
HTTPS redirect
Whether visitors who type http:// are moved to the secure version.
Security headers
HSTS, Content Security Policy, clickjacking protection, MIME sniffing, referrer and permissions policies.
Version disclosure
Whether your server announces software versions that help attackers choose an exploit.

Sources: PHP security advisory, 21 October 2026, PHP supported versions, WordPress 7.1.4 security release, 28 October 2026.

Read more

What these flaws mean for your business

  • PHP2Shell: is your website affected, and what to do today →
  • WordPress 7.1.4: the upgrade flaw site owners should fix now →
  • What it costs to keep a website patched and safe →

Stay patched

Never worry about the next one

Our managed service keeps PHP, WordPress, plugins and certificates up to date, monitors your site around the clock and tests backups by restoring them. When the next PHP2Shell arrives, it is already handled.

See managed services

FAQ

Website security questions

Which PHP versions are safe from PHP2Shell?+

The PHP project released fixes on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches is affected. PHP 8.1 and earlier no longer receive updates from the PHP project, so treat them as vulnerable unless your host has backported the fix.

Which WordPress version fixes the upgrade vulnerability?+

WordPress 7.1.4, released on 28 October 2026, fixes a weakness in the upgrade process that can lead to remote code execution. WordPress says the fix is being backported to older branches, so the newest security release of your branch may also include it.

Is this check safe to run on my website?+

Yes. It loads your public homepage once, the same way a browser does, and reads the response headers, certificate and page source. It never logs in, never submits forms and never tries to exploit anything.

My site hides its PHP version. Does that mean it is safe?+

Not necessarily. Hiding the version is good practice, but the only way to be sure is to check the version on the server itself, or ask your hosting provider to confirm it is on a fixed release.

What should I do if my site fails the check?+

Update PHP and WordPress first, because those flaws are being actively exploited. Then renew or fix your SSL certificate and add the missing security headers. If you would like help, send us the report and an engineer will tell you what to fix first.