security check for business owners

Is your website exposed to the PHP2Shell flaw?

Enter your website address and we'll tell you, in plain words, whether it appears to have the fix. We only read public signs, and nothing on your site is changed.

  • Read-only. We only look at what your site already shows the public.
  • Each check stops after 10 seconds at most.
  • No break-in attempts and no exploit traffic.

Check an address

Enter a public address you're allowed to check, such as example.com. Private and internal addresses are blocked.

What's going on, in plain words

  • What PHP is

    PHP is the language behind many websites: login pages, shopping carts, contact forms and content systems. It runs on the server, out of sight, like the kitchen of a restaurant. Visitors never see it, but its safety matters for everyone the site serves.

  • What happened

    On 21 October 2026 the PHP project released emergency updates for two serious flaws. Both are rated 9.2 out of 10, among the most serious. Sites on older releases stay exposed until PHP is updated, which usually means your hosting provider has to do it.

  • What an attacker could get

    Both flaws would let an outsider run their own commands on your server. In practice that can mean reading or changing files, taking customer data, or taking over the site. Nothing on this page exploits the flaws.

  • How this check works

    We make a few ordinary requests to the address you enter, the kind any browser makes. We read what the server reveals about its PHP version and protections, then give one of four answers: looks patched, partly protected, possibly exposed, or could not tell. We don't try to break in, and we don't run code on your site.

What this check does and does not do

  • Consent is required. You must tick the box above before each check runs.
  • Only the address you enter is checked, plus any redirects it sends us to, up to three.
  • Read-only. We only load your home page and one technical info page, /phpinfo.php. We send no upload and no exploit traffic.
  • Private, local, link-local and cloud-metadata addresses are blocked. Each check stops after 10 seconds. Each visitor can run up to 5 checks every 10 minutes for each address.
  • It does not prove your site is safe. A result can be wrong, and a fix can be in place without showing up here.