How the check works

• Your home page, the way any visitor's browser would load it, on desktop and mobile.
• The response headers your server sends with it, and its HTTPS certificate.
• A handful of well-known addresses: /robots.txt, /sitemap.xml, /llms.txt, /favicon.ico, and four files that should never be public (/.env, /.git/config, /phpinfo.php, /wp-config.php.bak).
• Your public DNS records for email (SPF, DMARC and MX).
• The home page again with three AI-agent user agents, to see how your firewall treats them.

• We never send attack payloads, try passwords, fill in forms or attempt to run code on your server.
• We never crawl beyond your home page and the addresses above. About 20 requests per check, total.
• If one of those sensitive files is exposed, we note that it's exposed. We never store, log or show its contents.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was patched on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We can only see the PHP version if your server announces it. When it doesn't, or when your host packages PHP itself, we say plainly that we can't confirm either way rather than guess.

We load your home page in a headless browser, take screenshots, and ask Claude (an AI model from Anthropic) to score it against a fixed rubric: first impression, main call to action, layout, trust signals, mobile, navigation, readability and freshness. It's told to describe only what it can actually see. Screenshots are shown to you once and never stored.

The domain you checked, the results, where you came from (UTM tags) and a hashed version of your IP address for rate limiting. If you unlock the full report, we also store your email and use it only to follow up about your report. See our privacy policy.

Our requests identify themselves as LudicrousSiteCheck/1.0 (+https://check.ludicrousdesigns.com/about). Someone entered your domain into this checker. If you'd rather we didn't check your site, email hello@ludicrousdesigns.com.