Check Your Website’s PHP Version

I added a free PHP vulnerability checker to Link Shield. Enter your website address and it checks the PHP version your server makes public. No account or API key required.

PHP released urgent security fixes on October 21 for two critical vulnerabilities known as PHP2Shell. If you run WordPress, Laravel, or another PHP application, updating your app or plugins alone doesn’t update the PHP runtime underneath them.

What the checker does

The tool sends one ordinary HEAD request to your homepage and reads its public response headers. It doesn’t send exploit payloads, upload files, or submit forms.

If the site reports a PHP version, the checker compares it with the first fixed release for that branch. You’ll see Potentially exposed, Fix version reported, or Patch status unknown, along with what to do next.

I checked php.testsparker.com as an example. Both public headers reported PHP 5.2.6, so the result came back Potentially exposed.

Some hosts hide the version. Others apply security fixes through vendor backports. A public header can’t tell the whole story, so confirm the PHP package serving your website with your host, even if the reported version looks current.

Link Shield grew out of the work I did to keep malicious links out of T.LY. I wanted to make this check easy for anyone running a PHP website, too.

Try the PHP checker on a website you own or have permission to assess. If it flags an older version, ask your host to confirm the fixes are installed.