Outdated dependencies, APP_DEBUG in production, a hidden webshell, a full disk,
silent spikes in error logs — find them before someone else does.
The free scan looks from the outside. Signing up adds a lightweight agent that checks from inside your server, on a schedule.
SSL certificate expiry, missing security headers, exposed .env / .git files, and response time — free and instant with no login, and once you sign up it re-runs automatically every 15 minutes. Every finding comes with a concrete fix, not just a warning.
Every monitored app's composer.lock is checked against known CVEs and security advisories automatically, daily.
Every report scans public/ for common webshell and backdoor patterns, so a compromised file doesn't sit unnoticed.
APP_DEBUG, PHP end-of-life, disk/RAM/swap usage, .env permissions, and error-log spikes — checked from inside your server via a small cron agent.
If your app uses a real queue, we confirm a queue:work process is actually running for it — a configured queue with nobody consuming it means jobs silently pile up forever.
Point us at your backup folder and we'll flag it the moment the newest backup goes stale — optional, since there's no single place backups live.
A monitoring tool that goes quiet is worse than useless. If your agent stops reporting — cron died, server's down, token revoked — we email you, not the other way around.
7-day uptime percentage and a downtime incident log per app, plus response-time and error-rate trend charts — so you see patterns, not just a snapshot.
Add an Incoming Webhook URL on a server's page and every alert that would go by email posts to Slack too — set it up under Servers → your server.
Turn on a read-only status page per server to share with clients — no login, just status, uptime, and a response-time trend chart, no internal details. Comes with an embeddable status badge for your own site. White-label (no PHPGuard branding) on the Agency plan.
Enter your domain above and get an instant external report — no account needed.
A single zero-dependency PHP file, dropped on your server and run via cron every 15 minutes.
We email you (and Slack, if you connect a webhook) the moment a new critical finding shows up — and if the agent itself goes silent — so you can fix it before it becomes an incident.
Simple, flat pricing. No per-server fees.
€0
€19/month
14-day free trial · no card required · cancel anytime
€49/month
14-day free trial · no card required · cancel anytime
The free scan checks your SSL certificate expiry, security headers, exposed .env and .git files, and response time from the outside. Once you sign up, a lightweight agent also checks APP_DEBUG, PHP end-of-life, disk/RAM/swap usage, .env permissions, error-log spikes, queue worker heartbeat, backup freshness, and runs daily dependency (composer) and malware scans.
The agent only ever sends check results (e.g. "APP_DEBUG is off"), never file contents or your source code. Sensitive fields like your Slack webhook URL are encrypted at rest, and two-factor authentication is available on every account.
Yes. Billing is monthly with no lock-in — manage or cancel your subscription anytime from the billing portal.
The external scan (SSL, headers, exposed files, malware) works on any PHP site. A few agent checks — like the queue worker heartbeat and .env permissions — are Laravel-specific.
Generic uptime tools only tell you if a page responds. PHPGuard also checks for the security issues specific to PHP/Laravel apps that cause real incidents: exposed .env files, known-vulnerable dependencies, webshells, and APP_DEBUG left on in production.
Agency includes everything in Pro plus white-label public status pages — no PHPGuard branding — for agencies sharing status pages with their own clients.
Yes. Every new account gets a 14-day free trial of everything in Pro. No card is required and nothing is charged automatically. When the trial ends, monitoring pauses until you subscribe, and your servers, settings and latest results are kept.