PHP code check · £19 a month
Find and fix the holes hackers use in your PHP code.
Check your website's PHP files for the flaws behind real mass website hacks: SQL injection, unsafe uploads, open admin actions, hidden backdoors and more. We rewrite the risky lines for you where it's safe to, and explain the rest in plain English. Your code never leaves your device.
The check runs in your browser. Nothing you paste or add is uploaded to Brightlock or anyone else. Folders called vendor and node_modules are skipped, because they hold other people's code that you update rather than edit, except for a known PHPUnit test file that attackers scan for.
Built from real attacks
The coding mistakes that have taken down real websites
Every one of these started with a small mistake in PHP code. The check looks for each of them, and fixes the ones that can be fixed safely.
A guessable security code
A caching plugin made its secret code with mt_rand(), which only had about a million possible values. Attackers guessed it to make themselves administrators, with over 48,500 attacks blocked in one day.
We swap in secure random codesXML that reads your files
The CosmicSting flaw let attackers read secret keys from online shops and plant card-stealing code on checkout pages.
We switch off the risky XML settingUnserialising visitor data
A donation plugin passed form data to unserialize(), which could let attackers run code and delete files. It was rated the highest possible severity.
We lock unserialize() downVisitor input run as code
Bricks Builder passed visitor input to eval(). Attacks began the day after the fix, and attackers switched off security plugins on sites they broke into.
We flag eval() and API routes with weak checksAn upload tool anyone could open
A file in WP File Manager could be opened without logging in, so attackers used it to upload backdoors.
We flag uploads with no login checkSettings anyone could change
Plugins that let anyone save settings or accounts were used to make attackers administrators, once within 90 minutes of a flaw being made public.
We flag missing permission checksSources: BleepingComputer on LiteSpeed Cache, Patchstack, SecurityWeek on CosmicSting, The Hacker News on GiveWP, BleepingComputer on Bricks, The Register on WP File Manager, Sucuri, BleepingComputer on OttoKit, VulnCheck on PHPUnit and Cybersecurity Dive on PHP ransomware.
What we look for
Ways in for attackers
- SQL injection in database queries
- Cross-site scripting: visitor text shown on the page unescaped
- Command and code injection, including eval()
- Files included, opened or deleted using visitor input
- Unsafe file uploads that could let someone add a PHP file
- Unserialising visitor data, open redirects and server-side requests
- WordPress actions, settings changes and API routes with no permission check
- XML settings that let visitors read your files
Weak spots and warning signs
- Passwords stored with md5 or sha1
- Passwords, keys and tokens written into the code
- Predictable tokens and loose password comparisons
- Error details or phpinfo() shown to visitors
- Removed mysql_ functions, a sign of an unsupported PHP version
- Patterns typical of a hidden backdoor (web shell)
- Upload checks that trust the browser or block instead of allow
- The PHPUnit test file attackers scan for
How it works
We follow anything that comes from a visitor, such as form fields, web addresses and cookies, through your code. If it reaches a risky function without being checked or escaped first, we flag it. We also look for settings and habits that commonly lead to hacks.
Where a fix is safe to make automatically, such as switching a query to a prepared statement or escaping output, we rewrite the line and give you the fixed files to download. Fixes that depend on how your site works are shown as suggestions for you or your developer to finish.
Good to know
This is an automated check, not a full security audit. It finds the common mistakes quickly, but it can miss problems and sometimes flags code that's actually safe. If your site takes payments or holds lots of personal data, have it reviewed by a professional too.
Using WordPress? Most hacks come from out-of-date plugins and themes, so keep everything updated and remove what you don't use. Need a hand fixing what we find? Ask about IT help.
Questions
What do I get for £19 a month?
Unlimited checks for as long as you're subscribed, so you can check every change you make and catch new problems before they go live. For every problem you see the file, the line, the code, why it matters and how to fix it. You can download your files with the safe fixes already made, and print the results or copy them for your developer. Before you pay, the free preview tells you how many problems we found, what kind, and how many we can fix automatically.
Can I cancel?
Yes, any time. You keep access until the end of the month you've paid for and won't be charged again. To cancel, contact us from the Help section of your account.
Can it fix my code for me?
Yes, for fixes that don't change how your site works: prepared statements for database queries, escaping text shown on the page, secure random codes, safe comparisons, turning off error display and risky settings, and similar. Each fixed file says at the top which lines were changed. Some fixes depend on your site, such as which pages may be included or who may change a setting, so we show those as suggestions instead. Always keep a backup and test the fixed files before putting them on your live site.
Is my code uploaded anywhere?
No. The check runs entirely in your browser. While you go to checkout or sign in, the code you've added is kept in this browser tab so you don't have to add it again, and it's cleared when you close the tab.
Does it help with Cyber Essentials?
Cyber Essentials covers your devices, accounts and software rather than your own code. But keeping software supported and up to date is part of it, so old PHP functions that only run on unsupported versions of PHP are worth fixing. If you build software for clients, buyers often ask how you check your code, and this gives you a first answer.
Can it check WordPress plugins?
Yes. Add the plugin or theme folder. For plugins you didn't write, the best fix is usually to update, replace or remove the plugin, and to report the problem to its developer.