Verification Plan
Last updated:
Tell us about the server and who asks you for proof. We reply by email to set up a short call about how read-only access works.
You’re asking about: Verification Plan
$990 per server per year, includes 1 site and the first verification
+$150 per additional site on that server, per year
capped at $2,190 per server per year, however many sites
Timeline: 12 months, quarterly
- At the start: a full Patch Verification & Compromise Review of the server. The first year includes it. If you bought one for the server in the last 60 days, that report is the baseline and its price is credited in full
- Months 3, 6 and 9: per-CVE patch status for every PHP runtime, what changed since the last verification, and automated compromise-indicator checks, in a dated one-page evidence letter for your insurer or customers, plus the full table (PDF and JSON)
- An event re-check after a qualifying advisory: a new PHP vulnerability affecting your server’s PHP branch and rated critical (CVSS 9.0 or higher, critical in php.net’s advisory, or listed in CISA’s Known Exploited Vulnerabilities catalog). The CVE-2026-115560 fix counts as one, whenever it ships