Service
PHP Security Audit
A clear list of what's exposed, in what order to fix it, and what you can ignore.
PHP · WordPress · Laravel
4-step process
- 4 clear stagesScope to Fix, if you want
- PHP, WordPressand 6 more in the stack
- 6 kinds of worklisted below
- Written estimatefixed price, before work starts
What this is
After PHP2Shell, plenty of owners asked the same thing: are we actually safe, and how would we know? A PHP security audit answers that. We look at the runtime version and handler, the web server configuration, the application's dependencies, upload and session handling, file permissions and what a stranger can reach from the internet. You get a prioritised list, not a 90-page scan export that nobody reads.
Who this is for
- Businesses whose PHP site was built by a developer or agency that is no longer around
- Companies that handle customer data, payments or patient records on a PHP application
- Teams preparing for a client security questionnaire or a vendor review
- Anyone who read about PHP2Shell and wants an honest answer on their own exposure
What problem this solves
If two or more of these sound familiar, it is worth a conversation.
Scanner output nobody can act on
Automated tools produce hundreds of findings. We sort them into what matters this week, what matters this quarter and what's noise.
Outdated plugins and packages
Old WordPress plugins and Composer dependencies are the most common way in. We list what's out of support and what replaces it.
Loose server configuration
Debug output left on, upload limits missing, writable folders and exposed backup files. Small things that make a bad day worse.
No idea what's reachable
Forgotten admin tools, staging copies and test scripts on the live domain. We find them before someone else does.
What Nimbryx actually builds
Every one of these is built around how your team already works.
Runtime & hosting check
PHP version and handler, patch status against recent advisories including PHP2Shell, and what your host controls versus what you do.
Dependency review
Composer packages and WordPress plugins and themes checked for known vulnerabilities and abandoned projects.
Configuration review
php.ini, FPM pool and web server settings checked against what the PHP project recommends for hardening.
Application review
Sampling of the code paths that handle login, uploads, sessions and database queries, to see where trust is misplaced.
Exposure check
What an outsider can reach: admin paths, backups, repositories, debug pages, directory listings.
Prioritised report
Findings ranked by risk and effort, with the fix described in plain language and a clear "do this first" list.
How this typically works
From the first conversation to a working system.
Step 1
Scope
You tell us the sites and access level. Read-only access is usually enough, and we sign an NDA if you'd like one.
Step 2
Audit
Configuration, dependency and application review, done by a developer reading your actual setup, not just running a tool.
Step 3
Report
A written report with priorities, walked through on a call so you know exactly what each line means.
Step 4
Fix, if you want
We can do the fixes, or hand the list to your own team. No obligation either way.
The stack we’d likely use
Mature, well-supported tools. The final choice depends on your project, and we explain it before we start.
- PHP
- WordPress
- Laravel
- CodeIgniter
- Composer
- MySQL
- Nginx
- Apache
An honest note
When this isn't the right call
This isn't a penetration test with a compliance certificate. If a regulator or a client needs a formal third-party pen test report, you'll need an accredited firm, and we'll tell you so. Our audit is for finding and fixing real problems in your application and server.
Not sure which side of the line you’re on? Ask us and we’ll say so.
How long does a PHP security audit take?
A single application usually takes a few working days, depending on size. We give you a timeline after a short intro call.
Do you need access to my server?
Read-only access to the code and server configuration is normally enough. We don't need to change anything to audit it, and we don't keep your credentials after the work ends.
Will the audit tell me if I've already been hacked?
It looks for signs, like unexpected files and suspicious logs. A full incident investigation is a different job, and we'd tell you if what we see points that way.
What does it cost?
Fixed price, confirmed in writing after we see how big the application is. We don't bill by the hour with the meter running.
Ready to talk about your project?
Tell us what you're trying to build. We'll reply within one business day with honest thoughts, not a sales pitch.
- First conversation is free
- Written estimate before anything starts
- You own the code