Check the PHP patch level of any domain

Reads what a site exposes: PHP version, security headers and cookie flags, JavaScript libraries with known vulnerabilities, WordPress core and plugin versions, web server versions. Compares each with its upstream and writes the check-and-fix prompt for your agent. Up to 300 domains at a time, or import a whole Cloudflare or Vercel account.

Domains

One domain or URL per line. Only the homepage is requested.

Try Import from

Prompts for agents

Every result above carries its own prompt with the evidence filled in. These are the templates behind it. Replace {{domain}}, or open one straight in your assistant.

PHP releases

Supported branches, live from php.net.

Loading from php.net…

Security release, 21 Oct 2026Fixes CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 remote code execution. Anything below the versions above is affected. php.net

How it works

One HEAD request to the homepage, GET when needed, up to five redirects.
Version read from X-Powered-By or Server. PHPSESSID, CMS markers and .php links separate "PHP, version hidden" from "no PHP".
The same response is graded for security headers and cookie flags, scanned for JavaScript libraries against the Retire.js database, and for WordPress core, plugin and theme vulnerabilities against the Wordfence Intelligence feed, plus web server versions.
Compared with php.net, endoflife.date, wordpress.org and Retire.js, cached six to twenty-four hours.
Each result gets a check, confirm, fix and verify prompt for your agent.

Most sites hide the version on purpose. PHP only sends X-Powered-By when expose_php = On; good hosts, Docker images and CDNs turn it off or strip it. "Version hidden" is expected, not a failed check. The patch level is then confirmed from inside, which is what the prompt walks through.

Verdicts

PHP verdict first; extra badges for headers grade, vulnerable libraries, CMS and server status.

latestNewest patch on its branch. outdatedSame branch, older patch. EOLBranch gets no fixes any more. distro buildDebian/Ubuntu/RHEL package; fixes may be backported. Check inside. partialOnly "PHP/8.x" exposed. PHP, hiddenPHP markers, no version. Check inside. not PHPNext.js, Shopify, ASP.NET and the like, identified from markers. no signalNothing PHP-related seen and no other stack identified. unreachableNo HTTP response.

API & MCP

No key. 20 targets per request.

GET  /api/releases
GET  /api/check?target=example.com
POST /api/check    {"targets": […]}
POST /api/import   {"provider", "token"}

MCP endpoint/mcp

claude mcp add --transport http phpcheck https://phpcheck.midego.net/mcp