PHP Version Checker – PHP2Shell & Vulnerability Check

PHP Version Checker scans any site PHP release and lifecycle to check PHP2Shell threats and check Vulnerability status easily.

PHP Version Checker helps developers, site owners, and security engineers understand the release risk behind any page they are browsing in seconds. When you open a site, the extension reads the public response of the page you loaded. It looks for a release signal in the X-Powered-By header, the Server header, and release tokens inside the first 512 KB of the body, then maps what it finds to the official lifecycle table and a bundled rule set. In one glance you see whether the branch is actively supported, in security-only maintenance, or end of life. If you want to check PHP2Shell relevance for your stack, the result shows the exact preconditions to review, and if you want to check Vulnerability context before an upgrade, the evidence panel gives you a clean starting point. 🚀 Features PHP Version Checker is built for daily development work, quick client reviews, and security triage. Every result shows evidence and confidence, so strong signals can be trusted and weak ones treated as leads. 1. Instant detection with honest confidence. A standard run sends at most two lightweight requests, a HEAD followed by a capped GET that stops after 512 KB, then extracts precise release numbers. Strong, moderate, and low-confidence clues are labeled separately, so you know when to confirm on the server and when to check PHP2Shell preconditions more carefully. 2. Lifecycle status in plain English. Each detected branch maps to active support, security-only maintenance, or end of life with end dates and a one-line recommendation. 3. Accurate matching without noise. The bundled rule set compares your exact patch number against affected ranges with an exclusive upper bound, so a fixed release is never flagged. If only a branch number is exposed, the verdict stays as needs verification. Environment conditions are evaluated separately, so not-applicable items are marked clearly and you can check Vulnerability impact without chasing ghosts. 4. Pro deep review for hidden exposure. Pro users can opt into a safe, read-only deep review with only public GET requests, no payload and no cookies. It reviews forgotten info pages, open status endpoints, handler fingerprints, and deny-list signals that headers alone would miss. Many auditors run PHP Version Checker first for the header view, then check PHP2Shell style exposure with the deep review before writing a ticket. 5. Platform context and clean reporting. When WordPress, Drupal, Joomla, or Laravel is recognized, the panel shows its official minimum requirement with a six-step upgrade list and server-side tutorials. Every run lists signal source, method, and timing. Pro users can copy the full Markdown report to review evidence with teammates and to check Vulnerability evidence during handoff. 📖 Usage You get value in under a minute with no configuration. Open any page, review the side panel, and decide whether deeper confirmation is worth your time. Teams often adopt PHP Version Checker as a pre-deploy ritual to check PHP2Shell signals on every release and to check Vulnerability state after each change. 1. Open the side panel. Select the toolbar icon in Chrome 114 or newer, or use the sidebar in Firefox. The panel follows your active tab and evaluates the public response automatically, without crawling the site. 2. Run a standard review. Press the action button while headers and a capped body sample are read, with results cached per site for six hours. 3. Read evidence before you act. Expand Evidence to see where the release string came from and how confident it is. 4. Review matched issues and platform notes. Open Known Issues to see affected, needs-verification, and not-applicable items with fixed-in releases. If a content system is detected, compare its minimum requirement with your branch and follow the linked Site Health path to confirm what production runs. 5. Go deeper with Pro when it matters. When headers are hidden or you inherit an unfamiliar server, run the deep review to examine forgotten pages and risky handler behavior, copy the Markdown report, confirm findings on staging, and re-run after patching to verify the new line is clean and to check PHP2Shell closure and check Vulnerability status once more. 💳 Pricing PHP Version Checker uses a simple two-tier model with no trial and no price shown inside the panel. Prices are managed on the ExtensionPay dashboard, and the tool only inspects whether your account is paid. Free covers one new site per calendar day. Re-examining the same host never consumes quota, and reading cache never counts. Only a network review against a new host consumes quota. Free excludes the deep review and report copying. Pro offers unlimited reviews with no daily cap, unlocks the deep review, and unlocks one-click Markdown report copying. To upgrade, choose Go Pro to visit the ExtensionPay payment page, or use Login if you purchased. ❓ FAQ Can the tool see the real release if headers are hidden? Not always. Removing release headers is correct hardening. In that case the panel honestly reports no supported public signal, shows platform and handler clues when available, and guides you to confirm the runtime on the server. Can I review high-impact issues on a site I do not own? You can review only public signals for pages you browse, comparing the detected line and environment conditions against bundled rules for awareness. The extension never sends exploits, never probes unpublished paths, and never claims a site is safe. For learning, many users open PHP Version Checker on a demo site, then study bundled references to check PHP2Shell context and to check Vulnerability notes that explain why a condition matters. Can a branch number alone prove patch status? No. A branch without a patch number cannot prove whether a fix is installed, so the match stays as needs verification. Find the full number on the server with the tutorials, then re-run to confirm applicability with confidence. Does it support WordPress, Laravel, and custom stacks? Yes. Fingerprints cover WordPress, Drupal, Joomla, Laravel, and common local dashboards, plus handler hints for common server interfaces. When WordPress hides its number, one extra REST API root request gathers platform context. Will reviews overload the target website? No. A standard run uses at most two small requests with a six-hour per-site cache, and even the deep review uses only safe GET requests with strict timeouts and byte caps. There is no crawling, no brute forcing, and no payload delivery. How should I handle an end-of-life finding? Treat it as a planning trigger. Confirm production, back up everything, test the target line on staging, switch the runtime, restart services, regress key flows, keep a rollback snapshot for 24 to 48 hours, then re-run to verify the new line. ⚠️ Disclaimer PHP Version Checker observes publicly exposed signals and maps them to lifecycle dates and known patch ranges. Results describe release risk, not exploitability, and a match does not mean a site can be compromised. Missing output does not prove a site has no runtime, and a clean match does not certify that themes, plugins, or custom code will work on a newer line. Always confirm on the server, test upgrades on staging with a rollback plan, and consult qualified professionals before making security decisions. The authors provide the software as is for defensive awareness without warranty.