Terms of use

Last updated: 2026-10-22

php2shell.app checks whether websites report a PHP version affected by CVE-2026-109618 and CVE-2026-109619 and explains how to fix it. These terms cover the free checker, the AI assistant, AI credits and paid bulk reports. Contact: contact@php2shell.app.

Acceptable use

You may use php2shell.app only to check and secure websites and servers that you own or are explicitly authorized to test. In particular you must not:

• Check websites you do not own or have no written permission to test, or submit lists of third-party websites to find vulnerable ones.
• Use results, reports or AI answers to attack, exploit, extort or harass anyone, or to plan or support unauthorized access to any system.
• Ask the AI assistant for exploit code, proof-of-concept payloads, attack steps or ways around security controls. It is built to refuse, and such requests may be logged as refused (without their content).
• Upload screenshots or paste output that contains other people’s personal data, credentials, keys or passwords. Crop or remove them first.
• Automate the free checker or the AI assistant (scripts, bots, scraping), get around rate limits or bot protection, or resell access to the service.
• Submit content that is unlawful, malicious, or intended to overload or disrupt the service or the websites being checked.

The checker is passive: one ordinary GET request to a site’s homepage (plus up to three redirects), with no exploit, no POST body and no path scanning. We publish no exploit code. We may block access, refuse or cancel orders, and report abuse to the relevant provider when these rules are broken. Orders cancelled for abuse are not refunded.

AI assistant

The AI assistant reads output you paste and writes fix plans and messages to your hosting provider. Verdicts and version numbers come from fixed rules based on php.net, the PHP security advisories and official distribution trackers; AI text is checked against those facts and withheld when it does not match. AI text can still be incomplete or wrong. Review commands before you run them and confirm the result on your server. See the privacy policy for what is sent to the AI provider.

AI credits

• Credits are a one-time purchase: 10 for $4.90, or 40 for $14. There is no subscription and nothing renews. Credits do not expire.
• Checking a website address is free. One credit is used when a reply is shown: reading output you paste, a fix plan, or a message to your host. A reply that fails is not charged.
• Payment is processed by Waffo, our merchant of record, which also handles sales tax and receipts. Prices are in USD; tax may be added at checkout. The balance is a private link emailed to you. Anyone with the link can spend the credits.
• Fix plans inside a paid bulk report are included in that report and do not use credits. Credits are for the assistant on the checker and the self-check page.
• Credits are added to your balance when payment succeeds. If something went wrong, write to us within 14 days. Except where the law requires it, credits that have already been spent are not refunded.

Paid bulk reports

• New payments are the two credit packs above. Starter ($9.90), Team ($29) and Agency ($79) are no longer sold. A report that was already paid keeps that plan: up to 25, 200 or 1000 sites, with the rechecks and the link lifetime of the plan you bought. There is no subscription and nothing renews.
• Payment is processed by Waffo, our merchant of record, which also handles sales tax and receipts. Prices are in USD; tax may be added at checkout.
• Each plan includes the rechecks described on the bulk report page during its recheck period, and the report link stays available for30 (Starter), 60 (Team) or 120 (Agency) days. After that the report and your list of sites are deleted.
• Checking a list is free. You see the totals before you pay, and a report can only be bought once at least one site on the list could be checked. Payment unlocks the full report of that check (or of a fresh check, if the free one is more than a day old).
• Refunds: if a paid report is checked from scratch and not a single site can be checked, we refund the order in full. Otherwise reports are delivered when they are unlocked and are not refundable, except where the law requires it. If something went wrong, write to us within 14 days and we will look at it.
• You are responsible for the list you submit and for keeping the report link private; anyone with the link can view the report.

No warranty

Results are based on what a website reports publicly and can be wrong: headers can be hidden, stale, or set by a proxy. A "fixed" result is not proof of safety. Always confirm on the server. Content is provided as-is without warranty of any kind, and to the extent the law allows we are not liable for decisions made based on it. Our total liability for a paid report or a credit purchase is limited to the amount you paid for it.

Sponsored links

Some pages may contain clearly labelled affiliate links. They don’t affect the technical content or the verdicts.

Changes

We may update these terms; the date above shows the latest version. Orders already paid keep the terms that applied when you paid.