Is my site cooked?

Paste a URL. One passive GET reads what your server already tells the world, compares the PHP build with the patched table and answers in about five seconds. No exploit is ever sent.

Check a siteone passive GET
Check
Paste it here/check in TelegramTag the bot on XTry the demo serverabout five seconds · one GET
COOKINGDAY 02 · PHP2SHELL17 CHECKED2 COOKED20%20%
cooked 20%shielded 0%unknown 20%not PHP 60%fixed since first check 0
latest · patched upstream · 21 oct · 17 checks today, aggregates onlyOpen the tracker

One GET. One verdict.

One passive request, the same as any visitor makes. The verdict is a reading of what the server shows the world, never a promise.

01

Paste

A domain on the web, /check in Telegram, or tag the bot on X.

02

One GET

A single passive request to the root reads headers and HTML signatures. Nothing else is sent.

03

Verdict

The build is compared with the patched table. Verdict, fix and share card come back together.

unreachable is never shown as safe

Five verdicts.

One of five, every time. UNKNOWN and ERROR are never read as safe.

this checkCOOKED

A build in the affected range, no patched build seen.

this checkSHIELDED

A patched build, or a setup the pair does not reach.

this checkUNKNOWN

PHP seen, version hidden. Not safe by default.

this checkNOT PHP

No PHP signature in the headers or the page.

this checkERROR

Not reachable. Never shown as safe.

The free report. The advanced one.

Scans and free reports are always free. The advanced report runs more passive GETs and writes the fix for your host.

Report · freeevery check
1 GET

Verdict, stack, fix

  • The verdict
  • Detected stack: PHP build, server, CMS
  • The two CVE IDs
  • Patch target, or migrate off EOL
  • The php.net advisory link
  • A share card for X and Telegram

Always free. No account.

Report · advancedholders free · one-off for others
5 GETs

Fingerprint, risk, remediation

  • Up to five passive GETs
  • Fuller fingerprint: SAPI, upload progress, edge in front
  • A risk rating with the reasons
  • Hygiene flags
  • Remediation written for your host type

Free for holders above the threshold. One-off for everyone else: 0.05 SOL or the same in $COOKED (proposal).

Half of every $COOKED payment is burned (proposal).

Holders above the threshold get the advanced report free on every check and five /watch slots instead of one. $COOKED launches only after the scanner is live. It unlocks features. It is not an investment.

What holders get

Watch it daily

/watch re-checks the site every day and alerts on a verdict change or a new matching wave. One slot free; more for holders (proposal).

/watch in Telegram
/watch shop.exampleCOOKED
last check 22 Oct 2026, 09:14 UTCnext in 23 h
1 of 1 slot used · examplealert on change

Questions.

Is the check safe for my server?

Yes. It is one normal GET to your root, the same request any visitor makes. The advanced report adds up to four more. No exploit is ever sent.

Can UNKNOWN mean cooked?

Yes. The version is hidden, so the verdict cannot say. The advanced report reads more signals and gives a risk rating instead.

Do you publish vulnerable sites?

Never. Public stats are aggregates only. Your report has its own link and you decide who sees it.

My host manages PHP. What do I send them?

The patch target line from your report. It names the build to move to, or says migrate off EOL.

Check it before the wave does.

Free verdict, free report, share card. About five seconds.

Check a siteOpen the bot