PHP2Shell: verify your runtime patches Read guidance

Check your PHP website for visible security issues.

Get a free, read-only assessment of HTTPS, browser security headers and public PHP evidence. No email or login required. Download your findings and see what to do next.

The scan only reads what any visitor's browser can read. We never log in, never write anything, and do not save scan targets in our application database.

Public, read-only requests. No login, exploit attempts or database storage of scan reports. Requests are rate-limited; URL query strings are omitted.

Even when PHP is hidden, we can inspect the connection and public response headers. A clean public check cannot establish overall security or rule out a past compromise.

Found a problem — or can't tell? Talk to an engineer — the first call is free.