Five checks, all in your browser.
Paste or drop what you have. Each check reads only what you give it and reports findings with a stable rule id, a fix and sources. Nothing is uploaded.
PHP version
Paste php -v, phpinfo() output, or an X-Powered-By header to get a verdict for every PHP version it mentions.
Verdict
Found something at or above high severity? Head to the fix playbooks and read the PHP2Shell advisory. For a full host scan, install the CLI.
php.ini / phpinfo
Audit an effective PHP configuration for PHP2Shell interim mitigations and classic hardening gaps.
Drop a php.ini, .user.ini, FPM pool or phpinfo HTML file
Read locally in this tab. Nothing is uploaded.
Found something at or above high severity? Head to the fix playbooks and read the PHP2Shell advisory. For a full host scan, install the CLI.
composer.lock
Look up your locked Composer dependencies against the public Packagist security-advisory database.
Drop your composer.lock here, or click to choose
Read locally in this tab. Nothing is uploaded.
Only package names and versions are read, in your browser. The list of names is sent to the public Packagist security-advisory API to look up known advisories. No file contents are uploaded.
Found something at or above high severity? Head to the fix playbooks and read the PHP2Shell advisory. For a full host scan, install the CLI.
Code & webshells
Scan application files for risky code, obfuscated payloads and webshell indicators of compromise.
Drop a project folder or files here, or click to choose
Read locally in this tab. Nothing is uploaded.
Found something at or above high severity? Head to the fix playbooks and read the PHP2Shell advisory. For a full host scan, install the CLI.
Crypto keys
Find exposed private keys, Solana keypairs and seed phrases. Secrets stay masked; only public addresses are shown.
Drop .env files, keypair JSON, or source files here, or click to choose
Read locally in this tab. Nothing is uploaded.
Scans for exposed private keys, Solana keypairs and BIP39 seed phrases. Secrets are masked before anything is shown; only the public wallet address is displayed, so you know which wallet to rotate. Everything runs in your browser; nothing is uploaded.
Found something at or above high severity? Head to the fix playbooks and read the PHP2Shell advisory. For a full host scan, install the CLI.