Check your website for the most common vulnerabilities
Enter a domain for a passive, non-destructive scan — security headers, TLS, PHP/php2shell, exposed endpoints, SPF/DKIM/DMARC and more. Each issue comes with a plain-English verdict and a fix. No attack traffic, one domain at a time.
Check your website for the most common vulnerabilities
Passive and non-destructive — we only read what your server publicly returns (headers, TLS, DNS, open endpoints). One domain at a time.
Passive checks on publicly observable responses — not an exploit attempt. Confirm findings against your own configuration. Active tests (DoS/WAF probes) are available for domains you verify you own, in PALANIT Pro.
Run this scan in CI — on every push
The same passive check, as a GitHub Action. Drop it into your workflow and fail the build when a new issue appears — no attack traffic, no account needed. Add an API key for higher limits.
# .github/workflows/security.yml
- uses: stasxr/palanit-action@v1
with:
url: https://your-site.com
fail-on: highWebsite security check — FAQ
What does the website security check look at?
In one pass it checks: TLS version (and legacy TLS 1.0/1.1 downgrade), HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), software version disclosure, cookie flags (Secure/HttpOnly/SameSite), PHP / php2shell exposure, publicly exposed endpoints (Prometheus /metrics, Swagger/OpenAPI spec, /.git, /.env), a security.txt, and email/DNS hygiene (SPF, DKIM, DMARC, DNSSEC, CAA). Each item gets a verdict and a fix.
Is this safe to run on my site? Does it attack it?
It's passive and non-destructive. It only reads what your server publicly returns — ordinary GET requests, a TLS version negotiation and DNS lookups, exactly like a browser or SSL Labs / securityheaders.com / MXToolbox. It sends no exploit payloads and can't take your site down.
Why doesn't it run active tests like oversized-header or WAF-bypass probes?
Sending those against an arbitrary domain is active, intrusive scanning. We never do that anonymously against third parties. Those active tests (DoS resilience, WAF bypass) are available for domains you prove you own, in PALANIT Pro — where it's authorized testing of your own server, re-checked daily.
Can I monitor my site continuously?
Yes — PALANIT Pro re-runs this check on your verified domain every day and shows the status in your dashboard, so a regression (an expired header policy, a new exposed endpoint, a downgraded TLS) is caught automatically.
The PHP core config check (CVE-2026-109618) — how do I run it?
That one depends on a runtime setting that can't be read from outside. On your server run: php -i | grep session.upload_progress.enabled — the safe value is Off. The checker surfaces this command in the results.
Want it watched automatically? PALANIT Pro re-checks your verified domain daily. Also try the MCP config scanner and the php2shell checker.