Terms of service

Digital Leeks · last updated 26 October 2026

1. Who we are and how to reach us

Digital Leeks is a trading name of Northin Ltd, registered in England and Wales, company number 11685697, registered office 8 Keeling House, Claredale Street, London E2 6PG. Email hello@digitalleeks.com. "We", "us" and "our" mean Northin Ltd. "You" means the person or business using the checker or buying the service.

By using the checker or paying for the service you agree to these terms. If you're buying for a business, you confirm you're allowed to agree on its behalf.

2. The free checker

• It reads only the information your website shows to the public and compares what it finds with the PHP versions that include the PHP2Shell fix (CVE-2026-109618 and CVE-2026-109619).
• A green result is a strong sign, not a guarantee. An amber result means we couldn't tell from the outside, which is common and does not mean something is wrong. A red result means your site is showing an old or unsupported version.
• It is general guidance, not a security audit, and not advice about your particular situation. You shouldn't rely on it as your only check.
• We're not affiliated with the PHP project, WordPress, or any hosting company.
• You may only check sites you own, manage, or have permission to check, and you must not use the checker in a way that overloads it or any other site.
• We may change, pause or withdraw the free checker at any time.

3. The £49 check and report

If your check shows your site was already on a fixed version, or on a managed platform that handles PHP for you, that's a good result: you get the written all-clear and the job is complete.

4. Price and payment

The service costs £49, paid once. That is the full price; there are no extra charges. Payment is taken by Stripe through a secure payment link before we start. Stripe emails your receipt.

5. Timescale

• We'll email you within one working day of your payment to ask for your web address and your hosting details.
• We'll confirm your site's status and send your first update within two working days of getting what we need from you.
• How long the chasing takes depends on your hosting company. We'll keep you updated by email and tell you if we're stuck.

Working days are Monday to Friday, excluding bank holidays in England and Wales.

6. What we need from you

• You confirm that you own the website, or are authorised to manage it and to ask us to act on your behalf with your hosting company.
• You'll give us accurate information and reply to our emails reasonably promptly.
• If you give us a login to your hosting account, you confirm you're allowed to share it. We'll use it only for this job, we won't change anything without asking, and we'll delete it when the report is sent. We recommend a temporary user you remove afterwards.

7. No fix, no fee

This is our refund promise and it applies to everyone, consumers and businesses alike:

• If our check finds that your site needs the PHP2Shell fix, and your hosting company has not confirmed it's applied within 14 days of us first contacting them, we'll refund your £49 in full. You still keep the written report.
• If your site turns out to be already fixed, or on a platform that fixes it for you, the service has done its job (you know for certain, in writing) and no refund is due under this promise.
• If we can't do the check because we haven't received what we need from you within 30 days of payment, we'll refund you in full and close the job.
• If we decide we can't help at all (for example, your site isn't a PHP site, or the host won't deal with us), we'll tell you and refund you in full.

Refunds go back to the card you paid with, via Stripe, within 14 days of us agreeing them.

8. Cancelling (your 14-day cooling-off right)

If you're buying as a consumer (not for your business), the Consumer Contracts Regulations 2013 give you the right to cancel within 14 days of paying, for any reason. To cancel, email hello@digitalleeks.com saying you want to cancel. You can use these words: "I wish to cancel my order for the PHP2Shell check and report, paid on [date], email [your email]."

• By paying, you ask us to start work straight away, inside the 14 days, so you don't have to wait.
• If you cancel before we've sent your written report, we'll refund you in full. We won't deduct anything for work done.
• Once we've sent your written report the service is complete and the cooling-off right no longer applies. The no fix, no fee promise in section 7 still does.

If you're buying for a business, the cooling-off right doesn't apply, but section 7 does.

9. The watch-and-guide care plan (monthly)

We also offer a monthly watch-and-guide care plan. Until it opens, the "put me on the list" box on our site only adds your email and web address to a waiting list: nothing is charged, and you can ask us to remove you at any time.

• What you get: we keep an eye on your website and on security news for the software it runs on; when something matters to your site we email you a plain-English note saying what it means and what to do; where the fix sits with your hosting company we contact them, follow up until it is done and confirm to you in writing; and once a quarter we send a short written check-up.
• What it isn't: we don't log in to your site or change anything on it, and we can't update PHP or any other server software ourselves; only your host can. We can't promise that nothing will ever go wrong with your site. The plan is advice, monitoring and chasing, not insurance.
• Price and payment: the price shown on our site per month (currently £19 including VAT if applicable), taken monthly in advance by Stripe. We'll give you at least 30 days' notice of any price change.
• Cancelling: monthly, no minimum term. Cancel any time from the link in your Stripe receipt or by emailing hello@digitalleeks.com; it ends at the end of the month you've paid for and nothing more is taken. If you're a consumer, the 14-day cooling-off right in section 8 applies to your first payment too: cancel within 14 days of it and we'll refund it in full.

10. Our responsibility to you

• We'll carry out the service with reasonable care and skill, as the Consumer Rights Act 2015 requires. If we don't, you can ask us to put it right or refund you.
• We're not responsible for what your hosting company does or doesn't do, for how long they take, or for anything they charge you.
• We're not responsible for security problems unrelated to PHP2Shell, for anything that happened to your site before you hired us, or for anything that happens after your host has applied the fix.
• We're not responsible for losses we couldn't reasonably have expected when you bought the service, or for any business losses such as lost profits, lost data or lost custom.
• Our total liability to you for anything to do with the service or the checker is limited to the amount you paid us (£49).

Nothing in these terms limits our liability for death or personal injury caused by our negligence, for fraud, or for anything else the law doesn't let us limit. If you're a consumer, your statutory rights are not affected.

11. Complaints

If something's wrong, email hello@digitalleeks.com. We'll acknowledge within two working days and aim to sort it within ten. If we can't resolve it, we'll tell you about an approved alternative dispute resolution provider and whether we're willing to use it. You can also take it to the courts (section 13).

12. Changes to these terms

We may update these terms. The version that applies to your purchase is the one on this page at the time you paid. We'll update the date at the top whenever we change anything.

13. Governing law

These terms are governed by the law of England and Wales, and the courts of England and Wales can deal with any dispute. If you're a consumer living in Scotland or Northern Ireland, you can also bring a claim in your local courts.