Uspector
PHP Security & Exposure Analysis

PHP Security Inspector

Inspect publicly accessible PHP resources and identify information disclosure, exposed configuration files, and potentially sensitive diagnostic pages.

Only scan websites you own or are authorized to assess.
Try examples: • •

PHP Security & Exposure Analysis

Inspect publicly accessible PHP resources and identify common information disclosure and configuration exposure risks.

PHP Detection

Identify PHP indicators through HTTP responses, session cookies, and server information.

Version Disclosure

Identify PHP version information exposed through server responses and HTTP headers.

Exposed Files

Check for publicly accessible backup files, environment files, configuration files, and other sensitive resources.

phpinfo Exposure

Detect publicly accessible phpinfo pages that may reveal PHP configuration and environment details.

PHP Error Disclosure

Identify PHP errors and stack traces that may expose internal paths, application details, or implementation information.

Directory Listing

Identify accessible directory indexes that may expose files and application structure.

Understanding PHP Security Testing

PHP is a widely used server-side scripting language for building dynamic websites and web applications. PHP applications rely on server-side configuration, environment variables, application files, and runtime settings. When sensitive resources are accidentally made publicly accessible, they may reveal information that could assist an attacker.

Common PHP Information Disclosure Risks

Several types of publicly accessible resources can expose details about a PHP environment:

  • Configuration and environment files: Exposed files may contain application settings, credentials, or other sensitive information.
  • Backup files: Old copies of PHP scripts and configuration files may reveal source code or configuration data.
  • phpinfo pages: Diagnostic pages can disclose PHP configuration, loaded modules, paths, and environment details.
  • PHP errors: Detailed error messages and stack traces may reveal internal file paths and application implementation details.
  • Directory listings: Accessible directory indexes may expose files and application structure.

What This Tool Checks

Check What It Identifies
PHP Detection PHP indicators in HTTP responses and server information.
Version Disclosure PHP version information exposed through responses or headers.
Exposed Files Accessible configuration, environment, backup, and diagnostic files.
phpinfo Exposure Publicly accessible PHP configuration and diagnostic pages.
PHP Error Disclosure PHP errors, exception details, and stack traces.
Directory Listing Publicly accessible directory indexes.

Testing Scope & Limitations

PHP Testing performs external checks against publicly accessible resources. It cannot inspect server-side source code, internal configuration, or resources that are not exposed over HTTP. A result of "Not Detected" does not guarantee that a PHP environment is free of security issues.