PHP security check.
Enter your website's address and I'll check whether it runs PHP, which version it shows, and whether that version has the fixes for PHP2Shell, the critical PHP flaws patched on 21 October 2026.
This only reads what your site sends to every visitor. It doesn't test the flaw or try to get in.
What the checker looks at
PHP is the programming language behind WordPress and most other website systems. On 21 October 2026 the PHP project released urgent fixes for two critical flaws, known as PHP2Shell, which let an attacker take over a web server without a password. Attacks started before the fix was out.
The checker fetches your homepage once and looks at two things:
- The PHP version your server announces. Many servers include it in a response header, such as
X-Powered-By: PHP/8.1.2. If it's there, the checker compares it with the first version that includes the fix. - Signs that the site runs PHP at all, such as WordPress, Joomla, Drupal or Magento files, PHP session cookies, or links to
.phppages.
The versions with the fix
| PHP version | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No official fix. Move to 8.3 or 8.4 |
For what to do next, read my guide to PHP2Shell and what it means for your website.
Last reviewed
Questions people ask
Does this test whether my site can be hacked?
No. It only reads the page and headers your site sends to every visitor, the same as a browser does. It doesn't send the attack or try to get in. Actually testing the flaw can crash a site, so it should only ever be done by the site's owner or someone they've asked.
Why can't it see my PHP version?
Many hosts switch off the header that announces the PHP version, which is sensible. When that happens the checker can usually still tell your site runs PHP, but not which version. In WordPress you can see it under Tools, then Site Health, then Info, then Server, or your host can tell you.
It says my version is older than the fix, but my host says I'm patched. Who's right?
Possibly both. Some hosts, especially on Ubuntu and Debian servers, add security fixes to an older version without changing its number. If your host confirms in writing that the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619) are applied, that's the answer to trust.
Is my website address stored?
No. The address is used to fetch your homepage once, and I don't keep a list of the sites people check.
Want a second pair of eyes?
The tool gives you a start. If you'd like honest advice on your website, tell me what you're working on. No obligation.