Is your website exposed to PHP2Shell?

What we look at

Email

• Your SPF record, the list of services allowed to send mail as you.
• Your DMARC policy, which tells other mail servers what to do with mail that fails those checks, and where the reports go.
• DKIM signing for Microsoft 365 and Google Workspace, and who handles your mail.

Website

• Server headers. Many hosts name the exact PHP version on every page they send.
• Your homepage code, which often names the CMS that built it and its version.
• WordPress fingerprints: the readme file and public API that every WordPress install ships with.
• Whether a firewall or CDN, like Cloudflare, sits in front of your site.

We only read what your domain already shows the public: its DNS records and public web pages. We never send exploit traffic.

Seeing WhoodenTech-ExternalCheck in your server logs and didn't ask for a check? Email info@whoodentech.com and we'll exclude your domain.