Critical · PHP2Shell

Is your website affected by PHP2Shell?

Check any site's PHP version in seconds. If it's affected, get the exact fix for your hosting - no research needed.

I already know my PHP version

One normal page request. No exploit or attack traffic is ever sent.

How it works

Or click the Chrome extension icon on any page.

One ordinary GET request. We read the PHP version the server already advertises.

Affected, patched, or hidden - and what to do next for your hosting type.

The flaws are in the PHP runtime itself - WordPress, WooCommerce, Laravel, custom code.

Once a fix is public, unpatched servers become targets within days.

Many servers hide their version. That does not mean they are safe.

PHP 8.1 and older are end-of-life. The only fix is moving to a supported version.

Loading advisory…

Exact steps for your hosting, host ticket, rollback plan, recheck + PDF for one site.

Everything in Fix Pack for up to 10 sites a month, plus bulk check. Cancel anytime.

It says my PHP version is hidden. Am I safe?

Not necessarily. Find your version (WordPress: Tools → Site Health → Info → Server) and enter it to finish the check.

Does this tool attack or test my site?

No. It makes one ordinary request to your homepage and reads what the server publicly shows. It never sends exploit code.

I'm on shared hosting. Can I fix this myself?

Usually you can switch PHP in your panel. Installing the patched release is your host's job - Fix Pack includes a ticket you can send them.