← PHP2Shell: what UK website owners need to do
Is your website on a vulnerable PHP?
A free check for PHP2Shell, the two critical PHP flaws fixed on 21 October 2026. Enter your address and see what your server tells the world about its PHP.
Free. One normal page load of your home page, nothing more. How the check works
How it works
One page load, nothing more
The check sees exactly what any visitor's browser sees. Anything deeper needs the owner's permission and access to the server, which is how we do it for clients.
What it does
- Loads your home page once, over HTTPS, as a browser would
- Follows up to three redirects within the same site
- Reads the Server and X-Powered-By headers, cookie names (never their values) and the page's generator tag
- Compares any PHP version it finds with the fixed releases (8.5.12, 8.4.27, 8.3.36, 8.2.35)
- Spots Node.js frameworks such as Express and Next.js, and points you to the Node.js release of the same day
What it doesn't do
- Probe other pages, login screens or admin panels
- Send anything that could trigger the bug, or any form data at all
- Store your page, or tell anyone which sites were checked
- Prove a server is safe or unsafe: a version number can't show a backported fix or a missed restart
Most PHP sites don't reveal their version, which is good practice, so the most common answer is “runs PHP, version hidden”. Your host, or anyone with access to the server, can give you the definite answer.
For site owners: the check identifies itself as OnCompCheck/1.0 (+https://oncomp.co.uk/php2shell/check). To ask us not to check your site, email [email protected].