PHP2Shell Exposure Check. Free, from the outside.
Enter a website to see what it reveals publicly: whether it runs on PHP, which version it advertises, and which platform it's built on. Then see what to do next.
Check a website
We load your home page once, the way a browser would, and read what it reveals publicly. Nothing is attacked or scanned, and we don't store the address you enter.
What this can and can't tell you
An outside check has limits
Many servers hide their PHP version, and that's good practice. When a version isn't shown, this check can tell you a site probably runs on PHP, but not whether the PHP2Shell fix is installed.
A version number can also mislead. Linux distributions patch PHP without changing it, so a fully patched Ubuntu server can report PHP 8.3.6. The reliable answers come from the server's package version or from your host in writing.
Use the result as a starting point: look up the fix for your setup, or ask your host.
Next steps
PHP2Shell guides
What Is PHP2Shell? A Plain-English Guide for Website Owners
Read article →BlogPHP2Shell Fixed Versions: What to Install for Every PHP Branch
Read article →BlogHow to Check Your Website's PHP Version (7 Ways, No Developer Needed)
Read article →BlogPHP2Shell Interim Mitigations: Every php.ini Setting Explained
Read article →BlogHow to Restart PHP Workers After a Security Update (Every Setup)
Read article →BlogWhat to Ask Your Web Host About PHP2Shell (Copy-and-Paste Message)
Read article →Project Managers who will work with you on your project!
Wondering what this costs? Every service has published pricing — no discovery call required to see it.
View pricingWant someone to check and patch it for you?
Tell us your website and hosting, and we'll reply by email with what we see and the next step.
Get help with PHP2Shell →