Bulk PHP Version Checker
Checking a portfolio of client sites one by one is slow. Paste up to 20 URLs and run the same read-only PHP version check for each one. Results appear row by row, with the PHP version, support status, and PHP2Shell verdict.
Bulk tool
Check up to 20 websites in one batch
Enter one URL per line. The browser sends each URL to the same detection endpoint as the homepage, with at most three checks in flight. Expand a row to see the evidence behind its result.
Checks run 3 at a time. Each row calls the same read-only checker as the homepage. One failed row does not stop the rest.
How it works
A batch of independent, read-only checks
The bulk page is a browser-side wrapper around the single-site API. It does not create a long-running server job or a second detection endpoint. Each URL gets its own request, its own timeout, and its own result.
Paste up to 20 URLs
Put one website address per line. You can use a bare domain, http://, https://, or a URL with a path. Invalid and private addresses are rejected before any request is sent.
Three checks at a time
The browser calls the same /api/check endpoint used by the homepage. At most three requests run concurrently, and each URL is an independent check, so one failure does not stop the rest.
Results as they finish
Each row updates when its check completes. The summary shows the PHP version, branch support status, PHP2Shell verdict, and confidence. Expand Details for the raw evidence.
Reading the rows
What each result means
The short badges show the PHP version, the branch support status, and the PHP2Shell verdict. Confidence tells you how direct the evidence is: high means the version came from a response header, medium means PHP was detected without a clear version, and low means no direct PHP signal was found.
When the version is hidden, the row shows “No version” and a support status of Unknown. That is not a failed request; it means the site did not expose enough information. Open the single checker for the full 30-second self-check panel.
Limits and privacy
- Up to 20 URLs per batch, with three concurrent checks.
- The API allows 30 checks per minute per IP. A 20-site batch fits; a second batch within the same minute may be limited.
- Only public HTTP and HTTPS on ports 80 and 443. Private and local addresses are rejected.
- The checker never stores the URL list, sends POST requests to the target, or probes for vulnerabilities.
Troubleshooting
Why a row may fail
A failed row is independent of the rest of the batch. The other URLs continue checking. Common causes are an invalid address, a private or local network target, a hostname that cannot be verified, a website that takes longer than five seconds, or the shared rate limit.
A site may also return an error page or block the checker. In that case, the result is limited to whatever public headers were returned. A hidden PHP version is not an error; it is reported as Unknown so you can use the self-check methods instead.
FAQ
Bulk checker questions
Limits, rate limiting, privacy, and what the rows mean.
Related guides
- How to check PHP version on a server, cPanel, Plesk, XAMPP, or WordPress
- WordPress PHP version requirements
- PHP2Shell: CVE-2026-109618 and CVE-2026-109619
- PHP end-of-life and supported versions
Results are best-effort estimates from public data. A version number alone does not prove that a site is secure. Only check sites you own or are authorized to assess.
Need the full result for one site?
The single checker shows the full evidence panel and self-check instructions.