What a Health Check report looks like
After two days of read-only analysis you get a written report. Below is its structure, with an invented system as the example.
Illustration. The system, the findings and the numbers below are invented, so that no client is shown. The structure, the checks and the dates from php.net are real.
1. The summary on one page
A verdict in one sentence, the five biggest risks and the first three actions, written for the person who decides.
Example, invented: "The system can run safely for another twelve months, provided the three actions below happen first."
2. Versions and end dates
PHP, the framework, the database and the key dependencies, each with the version in use, until when it is supported (from the vendor's own page, with the date of the check) and the risk.
| Component | Version in use | Supported until | Risk |
|---|---|---|---|
| PHP (example) | 8.2 | 31 Dec 2026 (php.net) | Medium: plan the upgrade this quarter |
| Framework (example) | An older major version | From the framework's support page | Judged case by case |
3. Findings, ranked by risk
Every finding has a title, a severity (critical, high, medium, low), the evidence (file and line, a command, or a line of the inventory), why it matters in plain words and a direction for the fix. What I could not verify is marked as such.
Example finding, invented
Dependencies with known security advisories · Severity: high
Evidence: the output of composer audit in the inventory.
Why it matters: a package with a known flaw is the easiest way in for an attacker.
Fix direction: update the packages in a release of their own, with a test around them.
4. The plan in steps
Old and new run side by side, nothing stops. Every phase has a goal, a range of hours (never a single number), a check and a way back.
- Phase 0: a safety net (tests, backups, monitoring)
- Phase 1: bring the runtime and dependencies up to date
- Phase 2: replace the first slice
- Phase 3: the next slices
- Phase 4: retire the old part
5. What is not covered
A rewrite, a penetration test, changes to production, production data and anything that was not read. It is written in the report so nobody thinks it is covered.
6. The walkthrough
A one-page agenda and the proposal for the next step with a scoped price. That is a separate quote, valid 14 days.
How the two days run
- Before: a free intro call about the stack, what hurts, the hosting and deadlines.
- Day 1, morning: inventory, versions and end dates.
- Day 1, afternoon: security basics, change risk, findings with evidence.
- Day 2, morning: the plan in steps with ranges of hours.
- Day 2, afternoon: writing, proofreading, laying out the report.
- After: the walkthrough call.
The version table is the kind of thing you can check yourself in ten minutes with the PHP version check. If the findings point at security rules, Hardening is the service that fixes them, and the pricing page shows what each step costs.
Want one for your system?
Two days, read-only, fixed price EUR 1,080 excl. VAT (12 hours × EUR 90). Tell me what you run and I check that the Health Check fits before anything is booked.