Troubleshooting

Most problems with SixPreflight itself have a specific, mechanical cause — a file permission, a proxy, a mismatched address. Find your symptom below rather than reading the whole page.

The scan stops partway through with a PHP error

Your host has disabled a PHP function that SixPreflight calls to measure the server, and an older copy of the tool could not survive that.

On PHP 8, calling a disabled function is a fatal error rather than a warning. It cannot be suppressed with @, and the scan runner had no error handling around it — so one disabled function ended the whole scan with a stack trace instead of a report, including the ninety-odd checks that had nothing to do with it.

This is fixed. A disabled function is now a single row saying that value could not be measured, and the scan runs to the end.

"Set a password first" will not go away

config.php is not writable by the web server, so the browser form cannot save a password. Either make the folder writable, or set the password hash by hand as a fallback:

php -r 'echo password_hash("your-password", PASSWORD_DEFAULT), "\n";'

Paste the result into config.php as password_hash, then reload.

"Could not create preflight/config.php"

The folder itself is not writable, so the tool cannot even create its own config file from the sample. Make the folder writable, or copy the sample file by hand:

cp preflight/config.sample.php preflight/config.php

The page 404s

The folder is above your document root. On a correctly configured server the document root is public/, so anything placed above it is unreachable by URL. Move the folder into public/ — do not move your document root up just to reach a folder in the application root instead. See where the folder goes.

"Not allowed from this address"

Your IP address is not in the allow_ips list in config.php. The page prints the address that actually arrived and, if you are behind a proxy, what that proxy claims your real address is — see Security and privacy.

"Could not read .env"

The banner at the top of the page tells you which of two situations you are in. If artisan is present in the folder above, .env exists but is unreadable by the PHP user — fix the file permission. If artisan is not there at all, the folder is not inside a Laravel application — which is expected if you meant to run it in standalone mode, and a sign it is in the wrong place otherwise.

Exposure tests say "not tested"

The site did not answer a request from itself. Common causes: the curl extension is not installed, so nothing was ever sent; the server has only one PHP worker, so the request queues behind the scan's own probe and times out; outbound access to your own domain is blocked by DNS or a firewall rule; or a security tool has banned the server's own address for making requests that look like a scan. Check by hand:

curl -I https://your-domain.com/.env

A panel or section is empty

Usually a permission problem, not an absence — an unreadable log looks identical to a quiet one from the outside. Open the setup checklist; the list there names every input it could not read and gives the exact command to fix each one.

A finding looks wrong

Tell us. A green tick that was not earned, or a red flag on a server that is genuinely fine, is the worst thing this tool can do — and the thing it is built most carefully to avoid.

Removing it

Delete the folder once you are finished with it. It is password-protected and can be IP-restricted, but it reports server internals and has no reason to stay on a live site once your server is chosen and tuned.

rm -rf /path/to/your/site/public/preflight

That removes the saved scan history along with it. If you want to keep a record, export the runs you care about as plain text first — see Verify and history.