Security from your server log

Your access log already records every scanner that asks for your secret files. Skald reads it and tells you who is probing you, what they tried, and what applies to your stack.

Free, in 10 seconds Is your site exposed? Type your address: see your PHP, WordPress and Node.js versions as the world sees them, which advisories apply, and the proof for each finding. Check my site This week php2shell: what happened, what to do Two critical PHP flaws, attacks already seen. The facts with their sources, who is affected, and the fixed versions. Read the guide

Security in Skald

Your server log already shows who is probing you

Every request for /.env, /.git/config, a backup or a login page is a line in your access log. Skald reads that log, the same lines every other figure is counted from, and answers six questions, every figure counted twice.

Security, Is anything exposed?, with sample data: 2,145 scanner probes, 1,073 answered with a page, 1,072 of them the host's harmless page and 1 possible exposure, a request for /.env.production answered 200 with 1,873 bytes, with what to do; and each host's fallback page size. — **Is anything exposed?** Every probe that got a page back, set against the host's own harmless page. A different size is a possible exposure to open and check now.

Security, Who is scanning us?, with sample data: probes per day as a bar chart, what they looked for (secret files, cloud configs, admin panels, PHP scripts, WordPress), and one row per scanner with its country, requests, probes and signs such as sent to the bare IP. — **Who is scanning you.** One row per scanner: when, what it looked for, what your server answered, and signs like a forged referrer or a request to the bare IP.

Security, Your stack, with sample data: the PHP advisory card with Update needed for PHP 8.3.10 and no official fix for PHP 8.1.2, the Node.js advisory with Check your version, and what serves each host: nginx, PHP, WordPress and Next.js, with versions or not shown by the server. — **Your stack and advisories.** What serves each site, read from outside every day, set against advisories like this week's PHP and Node.js ones, with what to do.

Attack attempts: path tricks and injection in the address, login and form hammering, bursts.
Fake browsers: agents that claim to be a browser but never load your site's files.
Block list: the addresses to block, ready to paste into nginx, Cloudflare or fail2ban.
Alerts: a possible exposure or an advisory for your stack, to the people on each site, at once or in the daily mail.

See Security in the live demo Install Skald free

Skald tells you what applies and what was tried; it does not block attacks. Free to run on your own server, source-available (Elastic License 2.0). Your data, on your server, and you choose what is kept.

Live demo

Click around the real dashboard with sample data

Every section, 60 days of a made-up site. In your browser, nothing to install, no sign-up.

Open the live demo

Hosted Skald

Start free. We set it up for you.

30 days free, no card. Your account is ready within one working day. Or run it yourself, free, with the install guide.

Start free trial Join the beta