Outdated or end-of-life PHP
Which PHP version runs in production, and whether it still gets security fixes.
PHP security audit & fixes
Secure your PHP app before it gets hacked.
A security audit for custom PHP applications, written in plain English, with a fixed price for the fixes.
- Custom PHP apps
- Agencies
- Fixed-price quotes
- PHP version8.1 · end of life
- /.env readableno
- /.git exposedyes
- Composer advisories4 packages
- Debug outputoff
- Uploads run as PHPyes
- Session cookie flagsset
Example findings● 4 to fix
What we check
The issues we see most often in PHP apps that were built years ago and kept running.
Exposed .env, .git and debug pages
Secrets, source code and stack traces that anyone can download from the web.
Vulnerable Composer packages
Your composer.lock checked against published security advisories.
File uploads and injection
Uploads that can run as code, plus SQL injection, XSS and unsafe includes.
Auth and session handling
Password storage, login throttling, session cookies, CSRF and access checks.
Server hardening
PHP settings, file permissions, TLS and security headers, and what the web server exposes.
How it works
Free external scan
A read-only check of your public site. It shows what an attacker can see from outside.
Run a scan →Audit and written report
We review the code, dependencies and server setup, then write up what we found and how serious each issue is.
Book a call →Fixes or upgrade
Your team fixes it from the report, or we do it for a fixed price. That includes PHP and framework upgrades.
Ask for a quote →What you get
A plain-English report
Each finding explained: what it is, where it is, and what could happen. Readable by the owner, useful to the developer.
Prioritised fixes
Ordered by risk, so the things that could get you hacked this month come before the nice-to-haves.
A fixed quote for the work
One price for the fixes, agreed in writing. Nothing extra without your approval.
Pricing: fixed-price quote after a free 15-minute call. Run by Daniel Lasek, a developer who does hacked-server forensics.
Book the callBeyond security
Most security problems in older PHP apps are really maintenance problems. We can take on the longer work too.
Upgrades
PHP and framework versions moved forward step by step, with tests.
Refactors
Risky or hard-to-change code made safer and easier to work on.
Maintenance retainers
Monthly updates, patches and checks so the app does not drift out of date again.
New features
Once the codebase is safe, we can build on it.
Questions
Do you need access to our code or server?
Not for the free scan. It only reads your public pages. For the audit we need read access to the code repository, and ideally to the server configuration. We confirm you own the app, or are authorised to have it tested, before we start.
How much does an audit cost?
It depends on the size of the app and how it is hosted. You get a fixed-price quote after a free 15-minute call, in writing, before any work starts.
Which PHP versions do you work with?
Current PHP 8 code, and older PHP 7 and PHP 5 code that still runs in production. Old versions usually need an upgrade plan, and that goes into the report.
Do you fix the issues or only report them?
Either. The report is written so your own team can act on it. If you want us to do the fixes, they get their own fixed quote.
Will the audit break anything on the live site?
The audit is mostly reading code and configuration. Anything that could change data is tested on a copy or staging site. We do not run intrusive tests against production without your written approval.
Our site has already been hacked. Where do we start?
Clean it first. A hacked WordPress or PHP site is a flat $499 cleanup. The audit comes afterwards, so the hole they used does not stay open.
Already hacked? See hacked website cleanup. Not sure which PHP version you run? Read which PHP versions are end of life.
Start with a free scan
Read-only, about 30 seconds. Then book a 15-minute call for a fixed quote.