Disclaimer & privacy

How a check works

When you enter an address, our server visits that website and makes, in this order:

1. One request for the page you entered, following up to five redirects (for example from example.com to www.example.com). If the website has no working HTTPS, we try plain HTTP once.
2. Only if that page gives no clear answer, up to three requests on the same website, stopping as soon as we have an answer:
   • a made-up address ending in .php, to see how the website answers pages that don't exist;
   • /index.php, the usual start page of PHP websites;
   • /wp-login.php, the standard WordPress login page. We only load it; we never log in or submit anything.

That's at most eight requests per check, all ordinary GET requests, done within about 12 seconds. We read at most the first 512 KB of each response and look at:

• response headers, such as X-Powered-By and Server;
• the names (not the contents) of cookies the website sets, such as PHPSESSID;
• the page's HTML, for signs like a WordPress or Drupal “generator” tag, file paths typical of PHP software, and links to .php pages.

What a check never does

• It never tests for, triggers or exploits the vulnerability, and never sends anything designed to break or overload a website.
• It never logs in, fills in forms, runs the website's scripts or downloads images and files.
• It never searches for other parts of a website on its own.
• It never visits private or internal network addresses, IP addresses or non-standard ports. Only public websites can be checked.

How we reach a verdict

• Yes: we found at least one clear sign of PHP, such as a header that names PHP, a PHP session cookie, or software that only runs on PHP.
• Probably: we only found supporting signs, such as links to .php pages.
• No signs: we found nothing that points to PHP. This is not proof that PHP isn't used.
• Unclear: we couldn't see the real website, for example because a firewall, cookie wall or error blocked us.

If the page links to other parts of the same website (like a shop. or blog. address), we suggest them so you can check them too. These suggestions come from links already on the page and cause no extra requests. Each suggested check only runs when you choose to start it.

No guarantees

A check can only see what a website shows publicly, so it can never be completely certain. Websites can hide that they use PHP, firewalls can block us, and other systems (such as an admin area, webshop, mail server or intranet) may use PHP even when we find no signs of it. Any detected PHP version is the version the website reports, which may not reflect fixes installed by your hosting provider.

Everything on this website is general information, provided “as is” and without warranty of any kind. It is not professional security or legal advice, and it can be out of date, incomplete or wrong. Always confirm with your hosting provider, developer or IT team, and follow the official guidance from the NCSC and the PHP project.

Using this website

Use the checker only for lawful purposes, such as checking websites you own, manage or are responsible for. Don't use it to map or target other people's systems, and don't access it with scripts, bots or other automated means. We may block or limit access to prevent misuse; checks are rate-limited per visitor and per website, and excessive traffic is blocked automatically.

Liability

You are responsible for the security of your own systems and for what you do with the information on this website. To the fullest extent permitted by law, we are not liable for any damage or loss arising from the use of, or reliance on, this website, its results or its advice, or from any action taken or not taken because of it. This does not limit any liability that cannot be limited by law, such as liability for intent or deliberate recklessness.

Not affiliated

We are not affiliated with, endorsed by or acting on behalf of the PHP project, The PHP Group, the PHP Foundation, the UK National Cyber Security Centre (NCSC), NCSC-NL or any software vendor or hosting provider. “PHP” and other product names are trademarks of their owners and are used only to refer to them. Links to other websites are provided for convenience; we are not responsible for their content.

Privacy

We collect as little as possible. We don't create accounts, don't use tracking cookies and don't sell or share data for advertising. This is what happens when you use the website:

The address you check

It is used to run the check and is then discarded. We don't log or store it, or the result. To limit how often one website can be checked, we keep a one-way hash of its domain name (a scrambled code that can't be turned back into the name) for up to two hours. Share links keep the address after the “#” sign (like doiusephp.com/#example.com), a part that browsers never send to servers, so it doesn't end up in our hosting provider's logs either. It does stay in your own browser history.

Your IP address

Used to prevent abuse. For rate limiting we keep only a one-way hash of it, which is deleted automatically within two days. We never store your IP address in readable form.

Service providers

• Vercel hosts this website and runs its firewall. Like any web host, it processes technical data such as IP addresses and requested page addresses, and may briefly keep these in logs for security and operations. Vercel privacy policy.
• Vercel Web Analytics counts page views and how many checks end in each verdict. It uses no cookies and doesn't identify you, and we remove the checked address from every page view before it is sent. Analytics privacy.
• Cloudflare Turnstile checks that a person, not a bot, starts each check. Cloudflare processes technical information about your browser and connection for this, and doesn't use it for advertising. Turnstile privacy.
• Upstash stores the short-lived, hashed rate-limit counters described above. Upstash privacy policy.

Some of these providers may process data outside the European Economic Area. They do so under safeguards recognised by EU law, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Legal basis and your rights

We process this data based on our legitimate interest in providing a free, secure service and preventing its misuse (Article 6(1)(f) GDPR). You have the right to ask for access to, correction or deletion of your personal data, and to object to its processing. Because we store almost nothing that can identify you, there is usually little or nothing for us to share or delete, but we'll always answer your request; see the contact address below. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

For website owners

Seen our checker in your logs? It identifies itself with the user agent doiusephp-checker/1.0 (+https://doiusephp.com/disclaimer) and only made the few harmless requests described above, because someone entered your website's address. You can block that user agent if you prefer.

About this website

doiusephp.com is a personal, non-commercial project by Hein de Wilde. For questions, inquiries, or to report misuse, please send an email to info@heindewilde.com. We can't give advice about individual websites; for that, contact your hosting provider or developer.

We may update this page; the date at the top shows the latest version. Dutch law applies to this website and this disclaimer.