What to do about PHP2Shell

Look up a site from outside

This reads what a website shows to any visitor: whether it runs PHP, the version if it reveals one, and whether a firewall service sits in front. Most well-run sites hide their version, so often it can't give a verdict. Your actual version number is always the better answer.

Website address

Look up site

I own this website, or I have permission from its owner to check it.

We make one ordinary request to the homepage, the same as a visitor would. No attack traffic.

How the look-up works

The look-up loads the homepage once, following redirects, just like a browser. It reads the PHP version the server reports (if any), session cookies, signs of WordPress and other PHP platforms, and whether a service like Cloudflare sits in front. It never sends attack payloads, so it can't prove a site is safe or vulnerable.

Our requests identify themselves as whattodoaboutphp2shell. Only look up sites you own or have the owner's permission to check. You confirm this each time.

To stop misuse, each visitor can run 20 look-ups a day and 5 a minute. Each site can be looked up 30 times a day and 6 a minute. Results are reused for five minutes.

What we keep

Results are cached for five minutes, then they're gone. To enforce the daily limits, we count look-ups against a scrambled (hashed) form of your IP address and of the site name. The scrambling changes every day, so the counts can't be reversed or linked between days, and they're deleted the next day. We don't log the sites you look up. The site runs on Cloudflare, which processes standard connection data to deliver it.