In the news: a critical PHP security flaw affects many business websites. Is yours at risk?

Tailored copy
Free tool for small businesses

Free website security check for small businesses

Type in your website address to see, in plain English, any obvious security problems with your website, your email and your domain, and what to do about each one. It takes a few seconds.

Free and instant. We only look at what any visitor can see.

A free tool from Launch My Local Site, helping small businesses get websites that are secure, looked after and bring in enquiries.

What the check looks at

The things that most often catch small businesses out, checked the way any visitor or attacker would see them from outside.

A secure connection

Whether your site loads on https:// with a valid certificate, and sends visitors to the secure version automatically.

Out-of-date software

What your site is built with, whether the October 2026 PHP flaw applies, and any PHP or WordPress version your server gives away.

Email in your name

Whether scammers could easily send emails that look like they come from your business, such as fake invoices to your customers.

Your domain

When your domain is due for renewal, because a lapsed domain takes your website and email down with it.

Browser security settings

The main security instructions your site sends to visitors' browsers, explained in plain English rather than graded.

Insecure content

Images, scripts or styles on your home page still loading over an insecure connection.

Websites with less to go wrong

Websites on our own platform don't run PHP, WordPress or plugins. Each page is built in advance and served from Cloudflare's network, so there is no database or server software for an attacker to aim at, and nothing for you to keep updating. That is why the October 2026 PHP flaw did not affect them.

No website is risk-free, so we still look after the hosting, security and updates for £15 a month. The build is £450, and you pay only once you've approved it.

What this check can't tell you

This is a quick health check, not a full security audit. It only sees what is visible from outside, so a clean result means no obvious problems, not a guarantee that your website is secure. It cannot see your hosting account, your plugins' settings, your passwords or whether your site has already been broken into.

It also never tries to attack your site or test a security flaw. That keeps it safe to run on any website, but it means some problems only show up when someone looks properly. If your result raises questions, or you would simply like a second opinion, I'm happy to look at your site myself, free.

Questions about the security check

Yes. There is nothing to pay and no sign-up. You type in your website address and the results appear in a few seconds. If you would like a person to look at your site properly afterwards, that is free too, with no obligation.

Only what any visitor can see from outside: whether your site loads securely, what it is built with and whether the October 2026 PHP flaw applies, software versions your server reveals, the security settings it sends to browsers, your email protection records and when your domain is due for renewal.

No. It looks at your home page the way a browser does, plus public records about your domain and email. It does not try to break in, probe for hidden files or test any security flaw.

Not necessarily. It finds the obvious problems that can be seen from outside, which are the ones most often used against small businesses. It cannot see inside your website, your hosting account or your passwords. For that, someone needs to look properly, which we offer free with no obligation.

Partly. It can tell whether your website looks like it is built on PHP, for example with WordPress, and if your server reveals its PHP version, whether that version includes the October 2026 fix. Many servers hide their version, in which case the result tells you exactly what to ask your host.

Because one of the most common attacks on small businesses is not on the website at all: scammers send emails that look like they come from you, often fake invoices to your customers. Two free records on your domain, called SPF and DMARC, make that much harder.

Launch My Local Site, a Gloucestershire business that builds and looks after websites for small businesses. We built the check because most security tools are written for developers, and small business owners deserve a plain-English answer.

Want a person to look properly?

Send me your website address and I'll check it myself, then tell you clearly what matters for your business and what to do next. Free, with no obligation.

Ask me to check it