Current security alert · 21 Oct 2026
Your website is running.But is it really secure?
The current PHP security alert shows how quickly unnoticed risks can arise. WebGainer checks for free what can be seen from the outside, and also shows how well your website convinces customers.
- In about a minute
- Free, no account
- Security check + website analysis
Security check
PHP version: hidden
Website analysis
User guidance
3/ 10
If it hits you
What happens when strangers take over your website?
The flaw lets strangers run their own code on the server without a password. For your business, that can mean:
- 01
Strangers' content under your name
Your customers suddenly see porn, gambling or scam pages instead of your offer.
- 02
Strangers read along
Contact forms, customer data, orders. Or they plant malware that infects your visitors. In the EU, data breaches usually have to be reported within 72 hours.
- 03
Google warns, enquiries stop
Visitors see a red warning, your host takes the site offline, your emails land in spam.
- 04
Costly clean-up
First an expert has to check, at great effort, whether and where someone broke in. Often only a rebuild is truly safe afterwards.
The flaw is already being exploited. Attackers scan automatically for sites that haven't been updated yet.
The longer a known flaw stays open, the more likely it is to be found. Whether your site is one of them, your server often reveals from the outside.
More than a security check
One free check. Two answers.
After the news, many website owners are wondering whether they need to act. We tell you in plain words and check your whole website along the way.
Is my website affected?
We read what your server reveals from the outside and tell you whether to act and what to ask your host. What we can't see from the outside, we say too.
Does my website win me customers?
In the same run we rate ten areas: whether visitors understand your offer, trust you, get along on mobile and contact you. You see the three biggest levers right away.
You have nothing to lose.
- Free, no account
- Result in about a minute
- Full report free by email
- No technical knowledge needed
The alternative: ask your host and wait for an answer.
Three steps to a first assessment
- 01
Enter your address
Your website address, nothing else.
- 02
Check runs
About a minute. You can watch.
- 03
Result with next step
What we could see and what you do now.
What is PHP, and what does the flaw mean?
What is PHP?
The technology your website runs on at the server, on almost every WordPress site. You never see it.
What does the flaw mean?
Strangers can run their own code on the server without a password. That lets them change or take over a website.
What helps?
An update to a safe version: 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 or newer. Usually your host does this.
Sources: cyber security warning of the German Federal Office for Information Security (BSI), 21 Oct 2026 · security releases on php.net, 21 Oct 2026
No empty promise
One of three answers. And what you do next.
We tell you exactly what was visible from the outside, and nothing more.
Affected version reported
Update needed
Your server reports a PHP version that contains the flaw. Some hosts apply the fix without changing the number; we point that out too.
Next step
Ask your host to update PHP, or have us fix it at a fixed price.
Not clearly checkable
Version hidden
Your site runs on PHP, but the server doesn't reveal the version. From the outside we can't tell whether it is affected.
Next step
Look up the PHP version in your host's customer area or ask your host.
Nothing noticeable found
No sign from the outside
The server reports a safe version, or no PHP is visible. This is not proof of security, only what can be seen from the outside.
Next step
Keep making sure updates and maintenance happen regularly.
Who is behind it
We don't claim anything you can't check yourself.
WebGainer is run by Ralph Appel, founder of RAVARO Systems. He has been building websites for businesses since the days of HTML and Flash, and brings 20 years of experience in processes and root-cause analysis, including as a project lead at Mercedes-AMG.
We measured it ourselves
On 22 Oct we looked at the 24 websites we had checked most recently: 13 visibly run on PHP, 3 show their version. One of them reports an affected version, another one a version that no longer gets any updates.
Official sources, not guesswork
We compare against the German BSI warning and the official security updates on php.net, not rumours from forums.
You see every step
The check log shows what your server reports and what we compare it with. Your host can confirm it at a glance.
We also tell you what we can't see
Whether someone has already broken in, nobody can tell from the outside. If we can't see something, the result says exactly that.
- Website opened like a normal visitor
- Server replies: X-Powered-By: PHP/8.3.35
- Compared with the safe version: 8.3.35 < 8.3.36
- Plus: ten more points of your website rated
- → Result: Affected version reported
We only read what your server tells every visitor publicly.
More than technology
Your website is more than its PHP version.
While we check your website technically, we also rate the ten areas that decide about enquiries: whether visitors understand what you offer, whether the site works on mobile and whether Google finds it. With a score, evidence and a recommendation for each area.
This is what your result looks like
Your website is measurably losing enquiries right now.
Brewery, 20 findings. The three most expensive:
- Guidance3/10
- Offer3/10
- Speed2/10
This is what your result looks like after about a minute.
- First impression
- Does a stranger understand in three seconds what this is about?
- Guidance
- Does the visitor know what to do next?
- Trust
- Is there proof, or only claims about yourself?
- Offer
- Is it clear why someone should buy from you in particular?
- Copy
- Do you talk about the customer or about yourself?
- Design
- Does it guide the eye, or do people have to search?
- Mobile
- Does the site work where most visitors actually are?
- Speed
- Is the page there before the visitor is gone?
- Legal
- Imprint, privacy, cookies: clean or risky?
- Findability
- Can Google even tell what you offer?
And if your website needs more than an update?
Our websites need no PHP and no plugin collection; this flaw does not affect them. In the full report you can request a free draft of your new site.
Common questions
What you're probably thinking right now.
Are you attacking my website?
No. We open your website like any visitor and read what your server sends along on its own. We don't try out any flaw.
What if the version is hidden?
Then we tell you honestly, and you learn where to look it up yourself or what to ask your host.
My host says everything is up to date.
Good. Then the report shows that too. Some hosts apply the fix without changing the version number; we point that out as well.
What does it cost?
The check is free. For the full report you leave your email address. If you want the problem fixed, you get our fixed-price offer by email.