How it works
1 page load. Fixed rules. No guessing.
PHP Scanner looks at your site the way any visitor's browser does, then explains what that shows about PHP2Shell in plain language. Here is exactly what happens.
What we request
- 1 ordinary page load
- A GET request to the address you entered, plus at most 5 redirects. Nothing else on your site is requested.
- An honest name
- Our requests identify themselves as "Mozilla/5.0 (compatible; PHPScanner/1.0; +https://php-scanner.com/how-it-works)", so you can find them in your logs.
- Hard limits
- 8 seconds per request, 15 seconds in total, and at most 512 KB of the page.
- Public sites only
- We refuse private networks, local names and unusual ports, including when a redirect or a domain name points there.
What we read
- Response headers
- For example Server and X-Powered-By, which sometimes name the PHP version.
- Cookie names
- Names only, like PHPSESSID or wordpress_test_cookie. Never their values.
- The page's code
- Generator tags, file paths like /wp-content/, and links to .php pages.
What we never do
- No attack traffic
- We never send exploit payloads or test whether PHP2Shell works on your server. That would mean attacking it.
- No probing
- No logins, no form posts, no hidden-file or admin-page requests.
- No AI guessing
- Fixed rules decide every result, so the same page always gets the same answer. No AI model reads your site.
How we decide
- A version is shown
- We compare it with the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). PHP 8.1 and older no longer get updates from PHP.
- A Linux package
- Ubuntu, Debian and Red Hat add fixes without changing the version number, so we ask you to check with your host instead of guessing.
- PHP but no version
- We say so and help you find the version yourself, or give you an email for your host.
- A hosted platform
- Webflow, Shopify, Squarespace, Wix and similar platforms run their own servers, so there's no PHP for you to patch.
- The risk rating
- High, Medium, Low or None, with how much evidence it rests on and every reason. A hidden version is never rated Low.
What a passive check can't see
- Other servers
- We check 1 page. A store, a blog on another address or a client portal can run elsewhere.
- Patched numbers
- A version number is what the server says about itself; some hosts add fixes without changing it.
- Everything else
- This looks only at PHP2Shell. It is not a full security check, and no outside check can promise a site is safe.
Try it on your site.
Facts reviewed October 22, 2026.