PHP Version Check

Shows the PHP version on the toolbar icon as soon as a page loads — red when it is affected by PHP2Shell, green when it is fixed. Chrome asks you once to allow access to all websites. The extension only reads the response headers of pages you open anyway. Nothing leaves your browser.

The result sits on the extension icon, so pin it: puzzle piece in the toolbar → pin next to PHP Version Check. No badge means no sign of PHP. Tabs that were already open show it after a reload.

Off: the check runs only when you click the icon.

Stops scripts, frames, plugins and websockets on a site until it reports a fixed PHP version. A hacked server can serve harmful scripts to its visitors, and this keeps them off your browser. The page loads once more with the block in place and shows a bar with Allow on this site.

Needs Check every page automatically: the verdict has to be ready while the page loads.

Fix list

The releases that contain the fix, one per PHP branch. Branches older than the oldest one listed count as end of life. Change it when the next PHP bug comes out.

Node.js had its own security release on 21 Oct 2026 (fixed in 22.23.4, 24.22.1 and 26.12.1). Node servers hide their version, so the popup shows a hint when it spots a Node.js stack such as Express or Next.js. It never blocks anything.

Shows which PHP version a website reports and whether it is still open to PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

Your first run

  1. Open the website you want to check.
  2. Click the extension icon. The popup shows the PHP version, a verdict and the raw header it read under What the server shows.
  3. Changed something on your server? Click Check again. For the version on the icon of every site, switch on Check every page automatically in the Settings tab and pin the icon (puzzle piece → pin) — the version then shows on it as a coloured badge.

What the colours mean

  • Red — the version is older than the fix, or the branch (8.1 and older) gets no fixes any more.
  • Orange — can't be decided from outside: a Linux distribution build that may carry a backported fix, a hidden patch level, or a pre-release.
  • Grey "PHP" — the site runs PHP but hides the version.
  • Green — 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer (the built-in PHP2Shell fix list).

Block active content

In Settings, pick when Block active content applies: on affected sites only, or also on unclear ones. It works together with the automatic check. A blocked site loads without scripts, frames and plugins and shows a bar at the bottom; click Allow on this site there or in the popup to lift it. The block ends by itself as soon as the site reports a fixed version. Sites you allowed are listed in the settings, where you can remove them again.

The next PHP bug

Enter the new fixed releases under Fix list and click Save fix list. Every check uses the new list from then on. Reset to PHP2Shell brings back the built-in list.

Node.js

With Also look for Node.js on, the popup shows a second card when a site runs on a Node.js stack (Express, Next.js and others). Node servers hide their version, so the card tells you the fixed releases of the 21 Oct 2026 security release and what the server shows. It does not block anything.

Where it works

On every regular http and https website. Not on browser pages (chrome://) or the Chrome Web Store — Chrome blocks extensions there.

What it reads

Click check: it requests the page you are on once more (a HEAD request to the same address) and reads the X-Powered-By and Server headers, plus PHP cookies and the generator tag. Automatic check: it reads the headers of the page load itself, no extra request. It never requests other paths and never probes for the vulnerability. Results stay in this browser session.

What it does not do

  • It does not prove a site is safe. Many servers hide the PHP version, and a proxy or CDN can strip the header.
  • It can't see backports. Ubuntu, Debian and others fix old version numbers without changing them — that shows as orange.
  • It does not test for the exploit. It compares the reported version with the fix list (built in: PHP2Shell, as of 25 Oct 2026).
  • Blocking starts with the second load of an affected site: the first response arrives before the verdict, so the extension reloads the page with the block in place.
  • For your own server, check the version there: php -v on the command line or phpinfo().