Know what your website reveals.
Harden before peak season.
Audit your web perimeter before peak seasonal traffic spikes. Check whether your server is exposed to recent PHP CVEs, verify your session cookie defenses, and test for clickjacking risks in 30 seconds.
Website security, explained.
How can I check my website for recent PHP threats for free?
Enter your domain address into the JawsMint Free Website Security Checker. The scanner passively inspects your public HTTP response headers, evaluates whether an outdated or end-of-life PHP version is disclosed, cross-references official CVE advisories, and provides actionable remediation guidance in 30 seconds with zero signup required.
Is my website protected against recent cyber threats?
Our diagnostic matrix evaluates your public defense against the OWASP Top 10 attack vectors: credential theft, session cookie hijacking (missing HttpOnly/SameSite), UI clickjacking (missing X-Frame-Options), unencrypted Wi-Fi SSL stripping (missing HSTS), and automated bot reconnaissance. Run a free scan to see your exact threat posture.
What recent web vulnerabilities should I know about?
Active high-priority web risks include remote code execution (RCE) on unpatched PHP runtimes, cookie credential theft from missing security flags, and malicious iframe overlay (clickjacking). Automated botnets continuously index domains on Shodan and Censys to exploit servers disclosing outdated versions.
How can I protect my website from automated hacker bots?
Harden your HTTP response headers by disabling software version tokens (set expose_php = Off and ServerTokens Prod), enforcing HTTPS via Strict-Transport-Security (HSTS), blocking iframe framing via X-Frame-Options: SAMEORIGIN, and locking session cookies with HttpOnly, Secure, and SameSite attributes.
What if my PHP version is not detected?
If your PHP version is not detected, this is usually good security practice because your server is properly masking version tokens from automated scanners. If your site runs on Next.js, Node.js, or Python, PHP advisories do not apply. If you run WordPress, verify your active PHP version inside your hosting dashboard.
Can a free website security check tell me if my website is 100% secure?
No automated scan can guarantee a website is 100% immune to attacks. A public checker evaluates external perimeter defenses and configuration hygiene. Private application logic, backend database configurations, and authenticated user roles require comprehensive penetration testing and source code audits.
How can I find out what a website is built with?
Expand the Website Technology Checker section in your report. It analyzes public response headers, HTML meta generators, script asset references, and CDN signatures to identify frameworks (Next.js, React, Astro), CMSs (WordPress, Drupal, Shopify), and analytics libraries.
Does the checker change my website or run intrusive attacks?
No. The scanner makes standard public GET requests just like a regular web browser, follows normal redirects, and inspects public headers. It never sends malicious injection payloads, fuzzes hidden files, or executes intrusive exploit scripts.
Is the website security checker completely free?
Yes, the public diagnostic tool is 100% free with no registration, credit card, or email address required. You can review the findings, download a complete JSON report, or export a print/PDF summary at no cost.
Reference sources: PHP supported versions, PHP project advisories. Need help implementing a finding? .