All-in-one PHP security platform

Find the hole beforesomeone else does.

Security diagnostics built for PHP teams: static code analysis, response header grading and php.ini auditing in one place. Your code is analyzed in memory and never stored.

Scan my code Check my site

Open source · MIT license View the source on GitHub →

Live

5code scans run

15issues found

46sites graded

<?php
// login.php
$stmt = $db->prepare('SELECT * FROM users WHERE name = ?');
$stmt->execute([$_POST['user']]);

✓ 0 issues · Grade A+

A+ Our own security grade Checked daily with our Headers Checker · Verify →

18Security rules v0.1.0Latest release ✓ Tests passing Automated tests MITOpen-source license

Built by PHP Safe

Three diagnostics, from code to server configuration.

Pick a tool, paste your input and press the button. Your code is analyzed in memory and never saved.

1Paste your code or address
2Run the check
3Fix what we find, line by line

Paste a PHP file or a snippet. We read it with PHP's own tokenizer and point out risky lines with a fix for each one.

Code Scanner

Static analysis finds common patterns, not every bug. Use it with code review and the tools below.

Results will appear here.

Our open-source project

PHP Safe Guard v0.1.0 released

A dependency-free security layer for any PHP application. One line to install, published on GitHub under the MIT license.

Star on GitHub

Every check runs on code you can read.

Guard is an extra layer of defense. It does not replace prepared statements, escaping and keeping PHP updated.

# composer
composer require phpsafe/guard

; php.ini — protect every request
auto_prepend_file = /path/to/vendor/phpsafe/guard/shield.php

Shield

Blocks SQL injection, XSS, path traversal and malicious uploads before your code runs. Adds security headers and rate-limits logins.

Scanner CLI

The same engine as our online scanner, on your machine. Scan a whole project and fail CI when risky code appears.

Helpers

Small, tested functions for CSRF tokens, output escaping and safe file uploads.

Community token

$PHPSAFE, live on Solana

The community token behind PHP Safe. Market data refreshes every minute straight from the chain.

$PHPSAFE Solanapump.fun

Price USD

—

Market cap—

24h volume—

24h trades —

Buys —Sells —

Loading market data…

Data: DEX Screener · pump.fun

Pump.fun ↗ DEX Screener ↗ 𝕏 Community Share on 𝕏

For information only, not financial advice. Crypto assets are highly volatile. Always verify the contract address above before trading.

Roadmap

Built in the open. Here's what's next.

Every feature ships as open source under the MIT license. Tell us what you need and the most requested items move up.

Shipped6

✓Code Scanner18 rules with fixes
✓Headers CheckerGrades, TLS and certificates
✓php.ini AuditorRisky server settings
✓PHP Safe Guard v0.1CLI, Shield and helpers
✓Security rules libraryCWE and OWASP references
✓Grade badgeShow your A on any site

Building now2

CIin progress

GitHub Action

Scan every push and pull request. Findings appear right on the diff, and a failing grade can block the merge.

Guardin progress

Guard v0.2

More rules, SARIF reports for GitHub code scanning, and a baseline file to ignore known issues.

Next up2

Site

Dependency check

Upload composer.lock and see which packages have known security advisories, with the version that fixes each one.

Site

Site monitoring

Daily re-checks of your site. Get an email when your grade drops or the certificate is about to expire.

Exploring3

Guard

Laravel & WordPress

Framework-aware rules for Blade, Eloquent, wpdb and plugins.

Editor

VS Code extension

Risky lines highlighted while you type.

Site

Public API

Run checks from your own tools and dashboards.

Have an idea? Open an issue on GitHub. Every request is read.

Suggest a feature → Star to follow progress Follow on 𝕏

How to use PHP Safe

Secure your PHP app in 5 steps

01
Learn the basics
Work through the checklist below and know the common attacks.
02
Scan your code
Run the Code Scanner before every deploy.
03
Lock dependencies
Block packages with known vulnerabilities.
04
Harden the server
Fix php.ini and earn an A on the Headers Checker.
05
Add a shield
Put PHP Safe Guard and a WAF in front of your app.

PHP security rules · 18 rules →

Before you deploy

PHP security checklist

Tick each item once your project does it. Progress is saved in this browser only.

0 / 8

Use prepared statements for every query

$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$id]);

Hash passwords with password_hash()

$hash = password_hash($pw, PASSWORD_DEFAULT);
password_verify($pw, $hash);

Escape everything you print

echo htmlspecialchars($name, ENT_QUOTES, 'UTF-8');

Protect forms with CSRF tokens

$_SESSION['csrf'] = bin2hex(random_bytes(32));
hash_equals($_SESSION['csrf'], $_POST['csrf']);

Check uploads by content, not file name

$type = (new finfo(FILEINFO_MIME_TYPE))->file($tmp);
// allow only image/png, image/jpeg

Lock down session cookies

session_set_cookie_params([
  'secure' => true, 'httponly' => true, 'samesite' => 'Lax'
]);

Hide error details in production

; php.ini
display_errors = Off
log_errors = On

Audit dependencies on every release

composer audit

Copy & run

Quick start commands

Install PHP Safe Guardcomposer require phpsafe/guard

Scan your projectvendor/bin/phpsafe scan src

Block risky code in CIvendor/bin/phpsafe scan src --fail-on=high

Turn on Shield (php.ini)auto_prepend_file = /path/to/vendor/phpsafe/guard/shield.php

Audit dependenciescomposer audit

Find the hole beforesomeone else does.

Three diagnostics, from code to server configuration.

PHP Safe Guard v0.1.0 released

Shield

Scanner CLI

Helpers

$PHPSAFE, live on Solana

Built in the open. Here's what's next.

Shipped6

Building now2

GitHub Action

Guard v0.2

Next up2

Dependency check

Site monitoring

Exploring3

Laravel & WordPress

VS Code extension

Public API

Secure your PHP app in 5 steps

Learn the basics

Scan your code

Lock dependencies

Harden the server

Add a shield

PHP security checklist

Quick start commands