Outdated PHP is an open door.
Find out what your server is telling attackers.

This scanner reads the HTTP headers your website sends with every response, detects the PHP version they reveal, and checks it against end-of-life dates and known vulnerabilities — including the PHP2Shell remote code execution flaws. Paste one URL or ten.

One normal GET request per site. Headers only — nothing intrusive.

PHP version support timeline

Each PHP branch gets two years of active support, then two years of security-only fixes. After end of life a version receives no security patches — every exploit found later stays open forever.

Active support Security fixes only End of life — unprotected

Recently discovered PHP vulnerabilities

Security issues patched in 2026 releases. If a site runs an older patch — or an end-of-life branch — it is exposed to these.

Frequently asked questions

How does this scanner detect the PHP version of a website?
It sends a single normal HTTP request to your URL and reads the response headers. PHP commonly announces itself via the X-Powered-By: PHP/8.x.x header (when expose_php=On) or sometimes inside the Server header. The scanner also looks for the PHPSESSID cookie as a hint that PHP is present even when the version is hidden.
What is PHP2Shell and am I affected?
PHP2Shell is the name given to two critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618, an out-of-memory initialization bug, and CVE-2026-109619, a stale-request use-after-free), both rated CVSS 9.2 and exploited in the wild since October 2026. Every PHP version below 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 is affected — and end-of-life branches will not get a fix. If you run PHP, assume you're affected until you've patched and restarted PHP-FPM or your web server.
Why does it say "version not detected" for my site?
The most common reasons: the site sets expose_php = Off (recommended hardening), a CDN or WAF like Cloudflare, CloudFront, Akamai or Sucuri sits in front and strips origin headers, the web server removes X-Powered-By via config, or the site doesn't run PHP at all. Not detected does not mean not vulnerable — check your hosting panel for the real version.
Which PHP versions are safe to use right now?
PHP 8.4 and 8.5 are actively supported — but only at patch levels 8.4.27 / 8.5.12 or later (the PHP2Shell fixes). PHP 8.3 and 8.2 receive security fixes only (8.2 until Dec 31 2026, 8.3 until Dec 31 2027). PHP 8.1 and everything older is end of life and must be upgraded.
Is hiding the PHP version enough to be secure?
No. Hiding the version (expose_php=Off) is good hygiene but it's security through obscurity — attackers fingerprint PHP in other ways and exploit kits simply try the exploit anyway. The only real protection is running a supported branch at its latest patch level.
Will upgrading PHP break my WordPress, Laravel or OpenCart site?
It can, if themes, plugins or legacy code use removed features. The safe path: take a full backup, test on a staging copy, update the CMS or framework and all extensions first, then switch the PHP version. Most modern CMS releases already support PHP 8.3 and newer.

Need help upgrading PHP or making your site compatible?

If you want your PHP version upgraded — and your website made fully compatible with the latest PHP — I can help. WordPress, Laravel, OpenCart, Magento, CodeIgniter, custom PHP: all CMS and frameworks covered — on shared hosting, VPS, AWS, cPanel/WHM or Plesk — from compatibility audit to zero-downtime migration.

Get in touch

Portfolio · GitHub