These Terms of Use apply to your access to PHP2ShellChecker.io and its checker, guides and configuration generator (the "service"). The service is operated by Wenver Song. Questions about these terms can be sent to fanran10130@gmail.com through the details on our contact page.
Effective date and last updated: 2026-10-22
1. Using the service
These terms describe the conditions under which the service is offered. If you do not agree to them, do not use the checker or other service features. You must have the legal capacity required for your use, or valid authorization from someone who does. If you use the service on behalf of an organization, you must have authority for that use. Your mandatory statutory rights remain unaffected.
The current service is free and does not require an account, a payment method or an email address to run a check. These terms do not create a paid support agreement or a promise to monitor your website. Any future paid service would need its own clearly disclosed conditions; visiting this website does not enroll you in a subscription.
2. What the checker does
The checker makes a normal HTTPS GET request to a submitted public domain and examines public HTTP response information. Normal redirects may be followed. Where a PHP version is advertised, the service compares it with a reference table and returns a result and next steps. It does not run an exploit, submit a proof-of-concept payload, log into the target or verify the contents of installed packages.
References to a single check describe one requested operation; redirects can involve additional HTTP requests. Network failures, rate limits, security challenges or third-party restrictions may prevent a usable result. The About page explains the methodology and the Privacy Policy describes information processing.
3. Authorization and acceptable use
Only submit domains you own, administer or have permission to assess. You are responsible for ensuring your request is lawful and permitted by the relevant website owner and hosting arrangements. A publicly accessible domain does not by itself grant permission for every form of security testing.
You must not use the service to disrupt websites, harass others, bypass access controls, probe private networks or metadata services, disguise prohibited targets, distribute malware, or process information you have no right to share. Do not submit passwords, tokens, confidential URLs or unnecessary personal information. Do not circumvent Turnstile, rate limits or other service protections, or automate requests in a manner that harms availability.
The public interface is not a promise of an unrestricted bulk-scanning API. Please contact us before integrations that require sustained or high-volume access. Normal use must respect the current limits and the operator's reasonable measures to protect the service.
4. Results and important limitations
A result reflects the response visible at the time of the request. Public headers can be incomplete, misleading, cached, modified by intermediaries or absent. A content-delivery network may hide PHP entirely. Different domains, pools and paths may use different runtimes, and a package vendor may backport a fix without adopting the upstream version number.
A result reporting a fixed version is not a guarantee that a system is secure, that every worker is patched or that no other vulnerability exists. An affected result is not a substitute for checking a vendor's backported package. A hidden, proxied, unreachable or "no PHP detected" result does not establish safety. You remain responsible for verifying the running web SAPI and relevant package or hosting information.
The service is not a penetration test, an incident-response engagement, a professional audit, a security certification or an assurance that your organization meets legal or contractual obligations. The operator is not engaged as your security consultant merely because you use a free check.
5. Guides, commands and configuration output
Examples on the patch page require adaptation to your operating system, package source, PHP branch, service names and application. Back up your configuration and data, verify compatibility and have a recovery plan before applying changes. You or your administrator must decide whether a command is appropriate; the website does not execute the displayed server commands for you.
The workaround generator produces configuration text in your browser. It does not modify your server, confirm the setting was loaded or install a patch. Disabling session upload progress covers only specific confirmed paths and is not a complete fix for both CVEs. Verify the configuration on the web SAPI, restart the appropriate workers and complete the vendor's update process.
6. Availability, changes and access restrictions
We aim to provide a useful service but do not guarantee uninterrupted availability, a particular response time, permanent functionality or support within a fixed interval. Hosting limits, maintenance, security incidents, network issues or changes to third-party services may affect access. We may change, limit, suspend or discontinue features, and may restrict requests reasonably believed to be abusive or harmful, subject to applicable law.
There is no commitment to continuous monitoring, automatic alerts or historical result storage. You should retain any information you need for your own records without including unnecessary sensitive data. The application is not a backup service.
7. Content, references and third parties
Content and software made available on this website remain subject to applicable intellectual-property rights. You may use a result to administer an authorized website and may apply generated configuration in your own authorized environment. You may link to our pages and quote reasonable extracts with attribution where permitted by law. These terms do not grant a general right to republish substantial portions of the website, use its branding in a misleading way or imply our endorsement.
Third-party names and marks belong to their respective owners. PHP2ShellChecker.io is independent of the PHP project and Cloudflare. Links to official advisories, package documentation or other resources are provided to help verification; third-party sites control their own content, availability and conditions. Their information may change after a guide is written.
8. Privacy and messages
The Privacy Policy explains submitted domains, request metadata, Turnstile and email correspondence. Send only material needed for your inquiry. If you submit a correction or feedback, you allow us to review it and use the relevant suggestion to maintain the service; this does not transfer ownership of your unrelated material or authorize publication of your private correspondence or identity without a separate lawful basis.
9. Warranties and responsibility
To the extent permitted by applicable law, the service and its informational output are provided "as is" and "as available", without a promise of completeness, error-free operation, suitability for a particular environment or a guaranteed security outcome. Official vendor guidance and direct checks of the running system take priority over an inference from a public header.
To the extent permitted by applicable law, we are not liable for losses caused by reliance on an incomplete or inaccurate result, application of an unsuitable command or configuration, third-party behavior or an interruption to this free service. This includes indirect or consequential loss, such as lost profits, lost opportunities or loss of data, where the law permits that exclusion. These terms do not require you to waive rights or remedies that cannot lawfully be excluded.
Nothing in these terms excludes or limits liability for fraud, fraudulent misrepresentation, intentional misconduct, death or personal injury caused by negligence where exclusion is prohibited, or any other liability that applicable law does not allow us to exclude or limit. If an exclusion is not enforceable in your circumstances, the mandatory legal rules apply.
10. Concerns, disputes and mandatory rights
If you have a concern, contact fanran10130@gmail.com with the relevant facts so that we can try to resolve it. This invitation does not prevent you from contacting a regulator, seeking urgent relief or using a court or other remedy available under applicable law. It does not impose compulsory arbitration or a waiver of collective rights.
Applicable mandatory law determines rights and remedies that these terms cannot change, including consumer protections and access to competent courts. No clause here is intended to require a consumer to give up protections or a forum available under such law. If part of these terms is invalid or unenforceable, the remaining provisions continue to apply to the extent legally permitted.
11. Updates to these terms
We may update these terms to reflect changes to the service, its operation or legal requirements. The effective date above identifies the current version. Material changes will be highlighted on the website as appropriate and apply prospectively, subject to any notice or consent required by law. An update does not retrospectively remove an accrued mandatory right. If you do not wish to use the service under updated terms, stop using the affected features. For current operator and contact information, see About and Contact.