Ultari NEOen

What would you like to check?

Pick what you are curious about below. All from one domain, read-only, free for personal use.

Read-only external check · free for personal use · daily monitoring for business

PHP2Shell — is your site breached too?We check from outside for webshell upload and exposure signs, including CVE-2026-109618·109619 known as PHP2Shell. Free for personal use.Is your website safe right now?Enter a domain and we read-only check exposed files, certificates, server versions and signs of hacking. Free for personal use.Has my website been hacked?We check from outside for hidden spam links, crypto-mining scripts and hidden iframes on your homepage. Free for personal use.Is WordPress left open on an old version?We match your WordPress version against known-vulnerable releases and check exposed config, backups and directories.Is your certificate about to expire, or weak crypto left open?We check the certificate expiry date and whether old TLS 1.0/1.1 is allowed, using only the handshake. Free for personal use.Are your secret config files public?We check for publicly openable .env, .git, backup and DB-dump exposure. We never copy the secret values. Free for personal use.Are AI keys leaking from your source?We check for AI API keys embedded in pages and scripts, and AI model APIs or MCP endpoints left open without auth.Are your site's basic defense headers on?We read only the response headers to check whether defenses like HSTS, CSP, X-Frame-Options and Referrer-Policy are on. No attack requests. Free for personal use.Is a whole folder left wide open?We read from outside whether directory listing is on and exposes backup, upload or config folders in full. No attack requests. Free for personal use.Is your domain DNS locked down?We read your domain DNS settings only — CAA that limits who can issue certificates, DNSSEC that validates answers, MTA-STS that protects mail. Free for personal use.Is your .git folder wide open?A .git folder left in your web root can leak your entire source code, secrets and deploy history. We check read-only from outside. Free for personal use.Can anyone reach your admin login?We check read-only whether your admin and database tool logins are open to the internet — the first target for brute force if they are. Free for personal use.Is WordPress leaking your usernames?We check read-only whether WordPress leaks author usernames via /wp-json/wp/v2/users. If usernames leak, only the password is left to crack. Free for personal use.Is your server leaving risky methods open?We read the allowed HTTP methods via OPTIONS only. TRACE, PUT or DELETE being open raises the risk of tampering and hijacking. Free for personal use.Are cloud keys hard-coded in your pages?We check read-only whether cloud keys like AWS, Stripe, Slack or GitHub are mixed into your public pages and scripts. We never store the key values. Free for personal use.Is a backup file sitting on the open internet?We check read-only whether common backup and database dump files (.bak, .sql, .zip, .old) are public on the web. If open, your whole database may be leaking. Free for personal use.Is your site being used to attack without you knowing?We read-only check your homepage and inner pages for hidden mining scripts, webshells, malware markers (like wp-vcd) and hidden iframes. Free for personal use.
Check now, free →

How it works

Enter one domain and we read only what anyone can see on the internet to gather the risks. We send no attack requests, separate hard evidence from heuristic signals, and write “not seen” for what we could not observe.

About Ultari NEO → · Ultari NEO · a second opinion alongside your antivirus