Is your site's
PHP at risk?
Enter your address and see, in seconds, whether the PHP version your server reports is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the critical PHP flaw fixed on October 21, 2026. Your full website health report follows underneath.
- PHP version
- PHP2Shell exposure
- End-of-life PHP
- Hosted platforms
- Full website health
Free to use. No account needed. Want every check first? Use the website checker.
Your report
This is informational, read from what your server publicly reports on one page load. It is not a security audit, and it cannot see patches a host applied without changing the reported version. Fixed releases: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12.
Based on what one page load shows: security, speed, search visibility, AI search, email and domain, contact and trust. Lighthouse numbers come from Google and don't change the score.
Top things to fix
Nothing to fix from what we can see. Nice site.
What we can tell about the site
Security
HTTPS and the certificate, the protective headers a browser honours, and what the server reveals about itself. An at-risk PHP2Shell verdict is counted here too.
Looks fine.
Speed
What the page's own markup says about load speed, then Google's Lighthouse run on a simulated phone.
Nothing to flag in the markup.
Lighthouse (mobile)
- LCP
- CLS
- INP
- Source
Search (SEO)
The basics Google reads first: title and description, headings, structured data, share cards, robots.txt and the sitemap.
Looks fine.
AI search (ChatGPT, Perplexity, AI Overviews)
Can AI assistants read and recommend the site? Whether robots.txt lets their crawlers in, whether the text is actually in the HTML, and whether there's structured, quotable content.
Looks fine.
Email & domain
Read from DNS and the public registry, nothing from the site: can someone send mail pretending to be you, and is the domain itself safe.
Looks fine.
Contact & trust
Can a visitor reach you, find you, and believe the business is current.
Looks fine.
Scores come from one page load and the HTML as served. Sites that build themselves in the browser can score lower than they deserve; a human look is the fix for that. Lighthouse figures are Google's, measured on a simulated phone.
What the PHP2Shell results mean
| Result | What it means | What to do |
|---|---|---|
| At risk — old PHP, no official fix | Your server reports PHP 8.1 or older. Every one of those branches is affected and no longer receives official security fixes, so there is no patch to apply. | Move the site to a supported release (8.2.35, 8.3.36, 8.4.27 or 8.5.12, or later). Ask your host today. |
| At risk — update available | Your server reports a supported branch (8.2–8.5) but a release below the fixed one. | Ask your host to update PHP. On managed hosting it's usually one setting. |
| Runs PHP — version hidden | The site runs PHP (WordPress, a PHP session cookie, .php pages) but doesn't announce the version. Most sites, and a sensible setting. | Ask your host one question: has PHP been updated to a fixed release since October 21, 2026? |
| Reports a fixed release / no PHP seen | Either the server reports a fixed release (what it says about itself, not proof), or the site is built on a platform that patches its own servers (Wix, Squarespace, Shopify…), or we saw no PHP at all. | Nothing obvious for this one. If certainty matters, ask your host to confirm. |
About this check
PHP2Shell is a critical flaw in PHP, the software behind WordPress and about four in ten business websites, fixed on October 21, 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. This checker reads the version your server reports in its headers and page, compares it with those fixed releases and tells you which of the results above applies, then keeps going with a full health report: security, speed (real Lighthouse), search, AI search, email and contact, in plain English.
It loads your homepage the way a browser does and never tries the flaw itself: no exploit, no login attempts, no probing. That also sets its limit. A host that patched PHP without changing the version string still shows "at risk", and a site that hides its version can only be confirmed by asking the host. Four ways to find your PHP version by hand covers the confirmation.
Why this exists. We checked 10,226 New York business websites on October 21 and 42% run PHP. Of the sites that reveal their version, 95% reported an affected release. See the full report, or read what PHP2Shell is and what to do about it.
Common questions
How do I know if my website is vulnerable to PHP2Shell?
Your site is affected if its server runs PHP older than the fixed releases: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or any PHP 8.1 or older. This checker reads the version your server reports and compares it for you. If the version is hidden, ask your host which release you're on.
My result says the version is hidden. Am I safe?
Not necessarily. Hiding the version is a sensible setting, but it means we can't see whether PHP was updated. Ask your host one question: has PHP been updated to a fixed release since October 21, 2026?
Does this checker try the PHP2Shell exploit on my site?
No. It never sends an attack, logs in or probes. It reads the version your server announces on one ordinary page load, which is why it can't see a patch your host applied without changing the version number.
Are WordPress sites affected?
WordPress runs on PHP, so a WordPress site is affected whenever the server's PHP is below the fixed release, even if WordPress itself is up to date. Updating plugins or WordPress doesn't change PHP. How to update PHP on a WordPress site walks through it.
Are Wix, Squarespace and Shopify sites affected?
You shouldn't need to do anything. Those platforms run and patch their own servers, and the checker reports them as "no PHP seen". More on hosted platforms.
What should I ask my web host?
Ask: "Has PHP on my site been updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later since October 21, 2026, and if we're on 8.1 or older, when can we move to a supported version?"