Moodle
security scanner

Check your site for exposed files, missing security headers and outdated software.

Read-only checksNo Moodle login neededFree to use

What we check

Moodle site URL

https://

Email address

Add your email to receive a copy of your report.

WebbLMS can contact me about secure Moodle hosting

Include my anonymous score in the community average

Your report is generated live and not stored. We only save your contact details if you opt in above.

I confirm I am authorised to scan this site and agree to the terms of use.

Checking your site…0%

Progress is estimated while the checks run.

We couldn’t complete this scan

Scan results

PHP2Shell

Not assessed

No result was returned for this check.

CVE-2026-109618 · CVE-2026-109619 · Version check only. PHP advisory

out of 100

Calculating...

Need help with a finding?

Contact WebbLMS

What we check

HTTPS & TLS

Certificate validity, TLS version, HSTS headers, and mixed content detection.

Security Headers

CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.

File Exposure

Detection of exposed .git, .env, backups, SQL dumps, and sensitive directories.

Version Hygiene

Moodle and PHP version exposure, including a PHP2Shell version check.

Infrastructure

Directory indexing, server software exposure, and admin access controls.

Reading your report

Open a finding for an explanation and recommended fix.

What a finding tells you

Findings identify configurations to review. They do not prove that a site has been compromised.

What this scan cannot see

It does not log in, test permissions or plugins, exploit vulnerabilities, or inspect your server configuration. Hidden PHP versions and vendor backports require administrator verification. A strong score does not replace patching, monitoring, backups or a professional security assessment.

Read why we built the Moodle security scanner, or talk to our team.