PHP2ShellChecker.io is an independent, free tool operated by Wenver Song. It helps website owners understand what their site's public HTTP response reveals about its PHP version and what they should verify next. No account, subscription or email address is required to run a check.
Last updated: 2026-10-22
Why this website exists
Security notices can leave a site owner with a practical question: does my hosting environment need attention, and what should I ask my provider to do? This website brings a lightweight header check, PHP version references and concrete verification steps together. It is intended for people responsible for websites, including independent owners, developers and hosting administrators.
The checker is a starting point for that decision. It does not replace checking the PHP runtime actually serving a domain. The PHP2Shell overview explains the vulnerability context, and the patch guide covers upgrade and verification steps.
How a check works
- You submit a public domain name. The service validates the input and applies its request protections.
- A Cloudflare Worker sends a normal HTTPS GET request to the domain's root page. Normal HTTP redirects may be followed. The service does not submit an exploit, upload a file or attempt to log in.
- The service examines public response headers and the presence of a PHP session-cookie marker. An advertised PHP version is compared with the site's reference table.
- You receive a result, supporting response details and a suggested next action. If the version cannot be established, the result explains that uncertainty.
What a result can establish
A reported version is evidence about a response, not proof of the complete server's security. Headers can be hidden, modified, stale or served by a proxy. A distribution may backport a fix without changing the upstream version number. A command-line interpreter may differ from the PHP-FPM pool or Apache module serving the website.
A hidden version is not evidence of a patched installation. A result reporting a fixed version is also not a guarantee that every pool, container or application is up to date. Confirm the running web SAPI, the package vendor's security notice and any required restarts.
Sources, maintenance and corrections
Version references and technical guidance are grounded in the PHP project's security advisory. The dated advisory reference shown with results identifies the information being used; it does not imply continuous monitoring. Automated version tests check selected comparisons, but they do not certify every server configuration or independently confirm that a patch is installed.
If a version, statement or result appears wrong, please use the contact page or email fanran10130@gmail.com. Include the relevant page, the observed behavior and an authoritative source if available. Corrections are reviewed before publication; a report does not automatically change a result.
Independence and funding
This project is not affiliated with, endorsed by or operated by the PHP project or Cloudflare. Cloudflare supplies hosting and security infrastructure; that relationship is not a security certification. The current service is free and does not require a paid plan. The current pages contain no advertising or affiliate offers.
Your data and use of the service
The Privacy Policy explains submitted domains, Cloudflare processing, logs and contact messages. The Terms of Use explain authorized use and the limits of the service. The operator and contact point for this website is Wenver Song at fanran10130@gmail.com.