What it checks
SixPreflight runs its checks in ten steps, cheapest and most-likely-broken first — so the findings that would actually stop your shop opening show up while the slower steps are still running. Up to 169 individual checks live in the code, spread across those ten steps.
The ten steps
| Step | What it looks at | Checks | Real examples |
|---|---|---|---|
| System & hardware | The machine you are paying for | 7 | vCPU count, RAM, swap, free disk, load average, OS release, whether any backup tool exists at all |
| PHP runtime | The language the shop runs on | 21 | PHP version band, 25 required extensions, memory_limit, effective max_execution_time, display_errors, OPcache on/off, OPcache memory and file count, hit rate |
| Application health | Laravel and 6amMart itself | 23 | .env tracked in git, pending migrations, failed jobs, queue backlog, log size, error count in the log, whether the scheduler has ever run, module list valid, trusted proxies, install settings present |
Environment (.env) | The one file everything reads | 14 | duplicate keys, invisible \r characters, an invalid or shipped APP_KEY, APP_DEBUG=true, a malformed APP_URL, keys nothing reads, keys that go null once config is cached |
| Host identity & permissions | Who owns the files | 9 | public IPv4 and IPv6, the PHP user, file ownership, the six directories that must be writable, world-writable files, a world-readable .env, anything writable and executable inside public/ |
| Web server | nginx or Apache in front | 17 | handler type, gzip, server tokens, FastCGI read timeout, Apache modules and MPM, php-fpm worker count vs memory, the upload size chain, live compression, static caching, HSTS, certificate expiry |
| Cache, queue & realtime | Background work | 11 | queue connection, whether a queue worker is actually running and supervised, session and cache drivers, Redis, Memcached, Reverb credentials and scheme, Pusher credentials |
| Database configuration | Where the money lives | 34 | InnoDB buffer pool sized against your real data and RAM, redo log, flush method, max_connections against php-fpm workers, sql_mode, charset, PHP-vs-database clock skew, buffer-pool hit rate, temp tables on disk, database user privileges |
| Public exposure (deeper check) | What a stranger can fetch | 12 | HTTPS, .env readable over the web, .git/config readable, laravel.log served, an uploaded .php file actually executing, Debugbar or Telescope answering, installer database dumps left in place |
| Payments, email & SMS (deeper check) | The services that must work | 21 | a real SMTP conversation, a real Firebase token mint, a real Google Maps geocode call, payment methods usable, SMS gateway credentials, storage disk writable, maintenance mode, reCAPTCHA, timezone, currency |
The last two steps only run on a Deeper check — see Install SixPreflight for the difference between that and Check now.
Why no single scan shows all 169
The 169 is the ceiling across every mode SixPreflight can run in — not what any one scan actually produces. A few things reduce it on a real run, and each one is a reason, not a bug:
- One check exists only when there is no application.
db_standalonefires only on a bare server with nothing to hold database credentials — an installed shop never sees it. That is the 169th check, and it never appears alongside the other 168. - A Deeper check on a real install shows about 167. Two web-server checks are read straight from config on a quick check, but a Deeper check measures the same thing live off a real HTTP response instead — so those two step aside rather than adding to the total.
- A quick "Check now" tops out at 136. It skips the 12 public-exposure checks and the 21 payments/email/SMS checks, because those need outbound calls that only the Deeper check makes.
- Your actual web server narrows it further. Some checks are nginx-only, some are Apache-only, so a single server never sees both sets. On a real nginx box, expect a Deeper check in the low 160s and a quick check in the low 130s.
- A bare server with no application skips about 40 checks. The
.envchecks, the Laravel application checks, the 6amMart platform checks and the realtime checks all have nothing to read, so they stay quiet rather than failing.
So the honest way to describe it is "up to 169 checks" — and on your own install, run the Deeper check if you want the largest set that applies to you.
What is not part of the 169
Two more pages exist, and neither one counts toward the score:
- Live delivery tracking — 15 checks of its own, covering the Reverb process, the process manager, the listening socket, firewall, proxy, certificate, credentials, app keys, channel auth, config cache, queue, CDN and driver
- Test order alert — sends a real push notification to a real store or rider device through 6amMart's own artisan command, with a dry-run button that shows what would be sent without sending it
The live-tracking checks get their own page precisely because live tracking is optional — see Live delivery tracking for the full breakdown.
What comes next
Once a scan finishes, every result feeds into one plain-English verdict and a score — see Reading the report for how to read what you get back.