There's nothing for you to patch on your Webflow site: Webflow runs the servers, and you don't install or update PHP there. If your business also runs a WordPress blog, a booking tool or a portal on another address, check that address separately.
- PHP for you to manage
- No
- runs the servers
- Webflow
Why there's nothing to patch on Webflow
Webflow hosts and serves your site itself. You don't run or update PHP on it, so there's nothing for you to patch for PHP2Shell. PHP2Shell affects servers running PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). On a hosted platform like Webflow, the platform looks after its own servers.
Other parts of your business to check
Many businesses on Webflow still have something running on PHP somewhere else. Check each of these addresses separately:
- a blog or store on another platform
- forms that send to a PHP script on another server
- landing pages on a separate WordPress install
What PHP Scanner looks for on a Webflow site
When you check a Webflow site, PHP Scanner recognizes it from Webflow page attributes (data-wf-site) and Webflow headers such as X-Wf-Region, and shows "Nothing for you to patch" with the evidence.
Questions people ask
Is Webflow affected by PHP2Shell?
There's no PHP on Webflow for you to manage or update, so there's nothing for you to patch. Webflow looks after its own servers.
Does Webflow use PHP?
Your Webflow site doesn't run on PHP that you choose or maintain. If you moved from WordPress, make sure the old site isn't still live on another address.
What should I check instead?
Any other website, blog, store or portal your business runs outside Webflow. Enter each address in PHP Scanner.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.