Methods, significance and limits

Three ways to check, one assessment

All methods use the same fixed assessment rules. No generative AI is used. What differs is the source of the information:

• Check website: The version hint comes from an HTTP response header. It counts as an unverified version hint.
• Verification file: A small, signed PHP file on your web space reports the version your website actually runs. This is confirmed information.
• Assess version: The information comes from you. It counts as manual input and is not verified by the service.

How the external check works

1. The address is validated on our server: only http:// or https://, standard ports, no credentials, no parameters, no IP addresses. If no protocol is given, https:// is added; internationalised domain names are converted to their ASCII form.
2. The domain name is resolved via DNS. If even one address points to an internal, reserved or blocked network, nothing is fetched.
3. The connection is pinned to the validated IP address. The certificate and server name are still verified as usual.
4. A HEAD request follows. Only if the server doesn’t support HEAD (HTTP 405 or 501) is a GET sent, whose response body is aborted immediately.
5. At most three redirects are followed, and each target is validated again. There is no downgrade from HTTPS to HTTP.
6. Only the final response is assessed. The X-Powered-By and Server headers are evaluated, and only information explicitly marked as PHP (e.g. PHP/8.3.36).

The entire process is limited to 20 seconds. Your browser’s cookies, credentials or headers are not passed on to the target website. The target website sees our server’s IP address (195.90.214.181) and the identifier PHP-Checker/1.0 (+https://php-checker.de/pruefumfang).

Results and what they mean

Version hint below the fixed version

The reported version is below the first fixed version in the same branch. Check whether your provider has backported a fix, and arrange the update.

Version hint matches a fixed version

The reported version reaches the fixed version. The hint is not verified and does not automatically apply to all PHP processes.

Vendor check required

A vendor package with an older base version. A backport is only proven by matching vendor evidence for exactly this package and both CVEs.

Pre-release version – separate check required

Alpha, beta, RC or development versions are not approved for production use.

Branch without an official fix

For old branches (e.g. 8.1 and older), the PHP project does not name a fix. They are not considered fixed because of their version number.

Branch not in the check data

New or unknown branches are only assessed once reliable sources have been added.

Patch status cannot be determined externally

No usable, unambiguous or consistent PHP hint. This is not a security verdict – neither positive nor negative.

Check not completed

Error, timeout, block or abort. An incomplete check never gives the all-clear.

Limits of the result

• A version hint is not proof of a patch. Headers can come from a cache, proxy, protection system, error page or another application.
• A matching version confirms neither the installed package nor all running PHP processes. PHP-FPM is not generally exempt from the vulnerabilities.
• Actual exploitability is not checked.
• Compromise: not checked. An update does not rule out an earlier compromise.

What PHP Checker does not offer

Malware detection, port scans, full WordPress or CMS checks, checks of other software and automatic server repairs are not part of the feature set. Each of these tasks would require its own, clearly defined scope.

Protection against abuse

To prevent the service from being misused as an open proxy or against third-party servers, fixed limits apply per caller, per target website and for the service as a whole, plus a limited number of simultaneous checks. If a limit is reached, you’ll be asked to wait. If rate limiting fails, no requests are started.