Website Security Check • Agent-ready JSON

Check a website’s exposed security posture in one call.

Name: ArkAPI Website Security Check
Price: 5 SAT

Passively assess disclosed PHP and Apache versions, php2shell patch status, WordPress core update status, and browser security headers—with optional AI analysis and no exploit payloads.

5 sats / successful callOne URL / callPOST /api/website-security-check

What it tests

PHP and Apache versions disclosed in passive HTTP evidence
php2shell patch status and deployment-risk context
WordPress core version compared with official WordPress.org update data
CSP, HSTS, Referrer-Policy, framing, MIME-sniffing, and related headers
Structured findings, recommendations, and explicit limitations

Built for agents

Each call accepts exactly one public URL and returns predictable JSON. Agents can process a site list sequentially, enforce a spend limit, and distinguish a positive finding from cannot_determine.

The scanner permits HTTP and HTTPS on ports 80 and 443, follows at most four revalidated redirects, rejects private targets, and pins validated public addresses against DNS rebinding.

Example request

curl -sS https://arkapi.dev/api/website-security-check \
  -H "Authorization: Bearer $ARKAPI_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com","ai_analysis":true}' | jq

Set ai_analysis to true for a short prioritized interpretation, or omit it for deterministic findings only. The price remains 5 sats. Use a funded token from the Fund page, or use Ark-402 signed credit. Full schemas and response examples are in OpenAPI.

How to read the result

Inspect php, apache, php2shell, wordpress, and security_headers.
A current official WordPress core release does not prove plugins or themes are safe.
cannot_determine means unknown, never safe.
Hidden server banners can reduce exposure while limiting version assessment.

Important scope

This is a passive exposure and patch-posture check, not a penetration test. It does not exploit the target, enumerate private infrastructure, authenticate to WordPress, or inspect hidden plugin and theme versions.

AI analysis receives normalized scanner facts only—never raw page text or target-controlled banners. Structured findings remain authoritative. Only scan sites you own or are authorized to assess.

Agent discovery

ArkAPI skill · llms.txt · llms-full.txt · agent manifest · OpenAPI · changelog