How the SecurityReview check works
If you found this page through our User-Agent in your logs: hello. Here is exactly what we did and why.
Our bot
Every request from the check identifies itself with the User-Agent below and sends normal browser Accept headers. We only check a site after someone asks for it and confirms their email address, and they must confirm they own the site or have permission.
SecurityReviewBot/1.0 (+https://securityreview.schoolvision.io/how-it-works)
What the check requests
- Public DNS records for the site: A, AAAA, CNAME, NS and MX.
- GET / (your home page), following up to 5 redirects.
- GET /index.php.
- Only if the home page shows WordPress markers: GET /wp-login.php and GET /xmlrpc.php.
That is all. No query strings, no request bodies and no other paths.
What it reads
- Response headers such as x-powered-by and server, and the names (never the values) of cookies such as PHPSESSID.
- Hosting fingerprints, for example headers that show a site is served by a particular host or platform.
- From the page itself: the generator tag, signs of WordPress, Drupal, Joomla or Magento, the page title and the meta description.
- Status codes, and whether a bot challenge was shown.
What it never does
- Send exploit payloads, fuzz inputs or try passwords.
- Submit forms, log in or crawl your site.
- Connect to private or internal network addresses, or any port other than 80 and 443.
- Run more than a handful of requests, each limited to 10 seconds and 2 MB.
How we decide
The result is decided by fixed rules, not by AI. We only report "no PHP visible" automatically when the site is positively identified as running on a platform that cannot run PHP. Every other result, including anything uncertain, is reviewed by a person before it is sent.
What a passive check cannot tell you
Many servers hide their PHP version, and some hosts patch without changing it. A passive check can show signs of exposure, but only the server itself can prove it is patched. Your report explains how to confirm from your hosting account.
Questions or opt-out
If you would rather we did not check your site, or think something went wrong, email us and we will stop. You can also block the SecurityReviewBot User-Agent. chris@servicevision.net
Talk it through with a ServiceVision engineer. We'll go over what we found, what it means for your site and what to do next.
Book a call about your results (opens in a new tab)