Exactly what PatchTurtle looks at

PatchTurtle is a passive check. It reads the same public pages and headers your store sends to every visitor, and compares what it sees with published vulnerability data. It never logs in, never submits forms and never sends anything designed to exploit a flaw.

What we request

For each check we make at most 10 ordinary web requests to your store:

• Your homepage, over HTTPS first (plain HTTP only if HTTPS doesn’t answer).
• For WooCommerce stores: the public readme.txt of WooCommerce and of up to four plugins on our watch list that your homepage already references.
• For Magento stores: the public /magento_version address.

We also look up the latest WooCommerce release from WordPress.org. We follow at most three redirects, wait no more than five seconds for each request and read no more than 300 KB of any page.

What we look for

• PHP version, from the X-Powered-By or Server header, compared with the PHP2Shell affected ranges and PHP’s end-of-life dates.
• Platform and version: WooCommerce, Magento Open Source, Adobe Commerce or Magento 1.
• Plugins with known, widely exploited flaws, matched by version.
• Security headers such as Strict-Transport-Security and Content-Security-Policy.
• Version information your site gives away to anyone who asks.

How sure the results are

A version number is strong evidence, not proof. Linux distributions and some hosts backport security fixes without changing the visible version, and many servers hide their versions altogether. That’s why our results say “likely” or “couldn’t verify” rather than claiming a store is definitely vulnerable or definitely safe. This is not a penetration test.

How we avoid becoming a nuisance

• Results for each domain are reused for 24 hours, so a store is checked at most once a day however many people ask.
• Each visitor can run 3 checks a minute and 10 a day, and must pass a Cloudflare Turnstile check.
• We only check public websites on the standard web ports, never IP addresses or internal networks.

Our crawler

Requests come from Cloudflare’s network and identify themselves with this user agent:

PatchTurtleBot/1.0 (+https://patchturtle.com/bot)

Opting out

If you run a site and don’t want it checked, email hello@patchturtle.com from an address at that domain and we’ll add it to our exclusion list. You can also block the user agent above.