PHP2Shell Checker.

How this works

This tool sends a single GET request to the homepage you enter and reads the X-Powered-By and Serverresponse headers for an advertised PHP version string, plus response headers, cookie names, and a capped portion of the page's own HTML to recognise the CMS or framework underneath — WordPress, Drupal, Joomla, Magento, PrestaShop, Laravel, CodeIgniter, CakePHP, Symfony, or plain core PHP. It also looks up other known, publicly catalogued CVEs for the exact PHP version it finds via the National Vulnerability Database (NVD) — real data, not a guess. Nothing is run against the target beyond that one request, and no exploit code is ever sent. It doesn't log in, fuzz endpoints, or touch anything beyond the one page it's given.

A result of "not vulnerable" only means the server's own headers report a patched version — it isn't a full security audit. Many well-configured servers hide the X-Powered-By header entirely (a good practice in its own right), and most managed hosts and security plugins (Wordfence, iThemes Security, etc.) do this deliberately — in that case this check has nothing to read and can't confirm either way. If it detects a CMS, it says so and points you to where that platform shows its real PHP version (for WordPress: WP Admin → Tools → Site Health → Info → Server) or your hosting control panel. The supplementary NVD results can lag brand-new CVEs by days to weeks — that's a known limitation of NVD's own publication process, not something this tool can work around — so an empty list there isn't proof of safety either. If your site is affected, the fix is to update PHP to the patched release for your branch — 8.2.35, 8.3.36, 8.4.27, or 8.5.12 — through your host or package manager.