Read ordinary public responses.
Inspect response headers, a PHP-style cookie name and a bounded sample of homepage markup. No hidden-path enumeration or form submissions.
EXPOSURE INTELLIGENCE / TOOL 01 Public-response check
Is PHP behind
your website?
Start with the signals.
Know what needs a closer look.
01 / CHECK A WEBSITEHTTPS · homepage only
Look beneath the page.
Paste a website address. We’ll inspect its public response for PHP clues and any disclosed version.
No uploads. No exploit payloads.
Reading the public signals
One website. A bounded check.Validating the address and checking the homepage…
YOUR EXPOSURE REPORTILLUSTRATIVE SAMPLE · NO REQUEST SENT
PUBLIC VERSION
PATCH ASSESSMENT
RESPONSE
The evidence
WHAT THIS MEANS
What to do next
Scope & limitations ＋
EVIDENCE, WITH CONTEXTA clue isn’t
A clue isn’t
a conclusion.
Servers can hide PHP. Proxies can obscure the origin. A banner can be stale. This tool keeps those limits visible.
Separate evidence from assumptions.
PHP advertised in a header is stronger evidence than a .php link. WordPress markup can also come from a static export.
Verify at the source.
Confirm the PHP-FPM, web server or container version actually serving requests. A CLI version or WAF alone cannot establish patch status.
Does “no PHP signals” mean my website is safe?＋
No. PHP can be hidden, limited to another path or subdomain, or run behind an edge service. This tool does not prove PHP is absent and does not establish vulnerability status.
Will this test PHP2Shell exploitation?＋
No. It makes an ordinary HTTPS homepage request, with up to three validated homepage redirects. It sends no file uploads, memory-exhaustion requests or remote-code-execution probes.
What happens to the website address I enter?＋
The address is sent to this Cloudflare Worker to perform the check. The service does not save scan history, response bodies or cookie values. Cloudflare may process operational and security metadata. Turnstile is used to limit automated abuse. Downloaded reports are saved by your browser.
What if the site blocks the check?＋
The report will describe limited visibility, or show an error. Challenge pages, unsupported redirects, timeouts and network restrictions are not treated as evidence that PHP is absent.