What does php2shell.cc check?
The checker reviews PHP version and session clues in public HTTP responses and compares URL-encoded and multipart forms for POST, PUT and PATCH. It sends a plain marker field, without file parts or upload-progress fields, and does not attempt exploitation or remote code execution.
Which URLs can I check?
Submit only public HTTP/HTTPS URLs you own or are authorized to check. The API restricts destinations and ports, rejecting localhost, private networks and other disallowed targets; redirects are checked again. Avoid credentials, private tokens or sensitive query parameters in URLs.
Why are requests sequential, sometimes with more than seven rows?
The seven baseline checks are GET and two form types each for POST, PUT and PATCH. Each uses a separate API call and waits for a response. GET follows at most three redirects, adding a row per hop; forms do not follow redirects. Remaining checks are not sent if the baseline cannot continue or you stop the run.
Do 403, 405 or 200 responses prove protection or a fix?
No. Compare both form types under the same method rather than only against GET. Differences may come from a proxy, WAF, Web server or application. A 403/405 does not locate the rejection stage, and 200/3xx does not prove PHP parsed the body. Check headers, configuration, logs and patch records together.
Is the site safe if PHP or its version is not detected?
That does not establish safety. PHP identifiers may be hidden, or responses may come from a CDN, cache, static page or another application route. Remote results cover only these requests. Verify the PHP service, version and package patches actually serving the site, not just CLI php -v or public headers.
How do I verify patches and upgrade through BT Panel?
Check PHP or package-maintainer security advisories and patch records; vendor backports cannot be judged by the upstream version alone. In BT Panel, open Software Store → Installed, locate the PHP used by the site and install available security updates. Back up first, restart that PHP service and verify the application afterward. Check every active PHP version separately.
Can I run the curl checks myself?
Yes. The homepage includes a copyable Bash/curl script using a plain marker field to compare GET, URL-encoded and multipart responses. Set an authorized target, run it in a terminal and read the interpretation guide. Request methods may trigger application behavior, so confirm the target is suitable first. Self-checks do not replace server patch verification.
How can I report a failed check or unexpected result?
Email [email protected] with the check name, HTTP status, error message and reproduction steps, adding a redacted screenshot if useful. First check public reachability, redirects and access restrictions. Do not send passwords, private tokens, complete session cookies or URLs containing sensitive credentials.