Version 2026-10-21-r2 · Effective October 21, 2026 · Offer ends November 20, 2026

These terms are an agreement between CompleteTech LLC (“Complete Tech”, “we”, “us”) and the person who submits the free PHP2Shell scan request form, together with the organization that owns the website named in it (“you”, “Client”). You accept them by checking the agreement box and submitting the form. That submission is your electronic signature. We keep a record of it: the terms version, the date and time, the details you entered, and your network address. You can ask us for a copy at any time.

1. Your authority

You confirm that you own the website you entered (the “Website”) or are authorized by its owner to request security testing of it, and that you are at least 18 years old. Do not submit the form for a website you do not control, and do not let anyone else submit it for you. If your website is hosted by a third party, you are responsible for any notice or permission your hosting contract requires before external testing. If any of these confirmations is untrue, you agree to cover the reasonable costs and claims that result.

Before testing starts, we send a confirmation link to the email address you entered. Open the link and press the confirmation button to confirm your authority and the website scope. Merely opening the email or link does not start a scan. Callers may send you the request link, but must not sign or confirm on your behalf. Confirmation establishes control of the email address; it does not independently prove website ownership. The signed scope is the website hostname shown on the confirmation page. Other hostnames, including a www variant, require separate authorization.

2. What you authorize

You authorize Complete Tech to run the non-intrusive external checks in section 3 against the Website’s domain, from the date you submit the form until 30 days after the offer ends (December 20, 2026), or until we deliver your report, whichever comes first. We will not scan other domains, subdomains, IP addresses or systems unless you add them in writing.

3. What the free scan covers

  • PHP2Shell exposure: whether the PHP version and configuration the server reveals are affected by CVE-2026-109618 and CVE-2026-109619, the two flaws PHP fixed on October 21, 2026. We check this by version and configuration fingerprinting. We do not send exploit payloads.
  • Software versions: publicly visible versions of PHP, the web server, WordPress core, themes and plugins, checked against published vulnerability databases.
  • Transport and headers: HTTPS and TLS configuration, certificate validity and HTTP security headers.
  • Exposed files: common backup, configuration, log and debug files or directories that should not be public.
  • Signs of compromise visible from outside: known web-shell paths, malicious redirects or injected scripts, defacement and blocklist status.

Checks run at a low request rate from identified Complete Tech systems and are designed not to affect your site’s availability.

After confirmation, the automated PHP2Shell portion checks the PHP version advertised in public response headers. A potentially affected version is not proof of exploitability, and an advertised fixed version is not proof that the website is safe. Hidden, conflicting or vendor-modified versions may be inconclusive. The other checks listed above remain part of our separate review before the full report is complete.

4. What we will not do

  • We will not exploit vulnerabilities, attempt to log in, guess passwords, run load or denial-of-service tests, or change any data.
  • We will not access non-public data, contact your staff or users, or test systems other than the Website.
  • We will never ask for passwords, logins or hosting credentials by phone, text or email.
  • If we come across sensitive data or signs of an active compromise, we stop testing that area, do not keep the data, and tell you promptly.

Deeper testing (authenticated, file-level, or server-side) is a separate paid service. It needs its own signed authorization and statement of work.

5. Your report

We aim to send a plain-English report within five business days of your request. We send it only to the email address you entered. The report reflects what was observable from outside at the time of the scan.

6. Free fix with a 12-month hosting agreement

If the scan finds that the Website is affected by PHP2Shell, we will fix it at no charge if you sign a 12-month Complete Tech website hosting agreement by November 20, 2026, or within 14 days of receiving your report, whichever is later. The free fix covers:

  • moving the Website to Complete Tech hosting;
  • running it on a supported, patched PHP version;
  • reasonable compatibility testing and updates of the Website’s existing theme and plugins so it works on that version.

It does not cover rewriting custom code, buying paid licenses, recovering lost data, or responding to a compromise that happened before the fix. We will quote those separately, in writing, before doing any of that work. Other findings can also be fixed, on a quote. The hosting agreement is a separate contract with its own price and terms. Requesting the scan does not oblige you to buy anything.

7. Confidentiality and your data

We treat your findings and report as confidential and share them only with you and the people who help us deliver the service under the same obligation. We keep your request and acceptance record for three years and your scan results for twelve months, then delete them. We do not sell your information. Our Privacy Policy also applies.

8. No guarantee

No scan finds every weakness. The free scan and report are provided “as is”, without warranties of any kind, and do not guarantee that the Website is secure.

9. Limitation of liability

To the fullest extent the law allows, Complete Tech is not liable for indirect, incidental, special, consequential or punitive damages arising from the free scan or report. Our total liability for the free scan is limited to one hundred US dollars ($100). Some jurisdictions do not allow these limits; where that is the case, they apply only as far as the law permits.

10. Changing your mind

You can withdraw your authorization at any time by emailing [email protected] or calling 1-844-TECH-WIN. We stop scanning within one business day of receiving your request.

11. General

These terms are the whole agreement about the free scan. They are governed by the laws of Ohio, without regard to conflict-of-law rules. Any dispute will be heard in the state or federal courts in Hamilton County, Ohio. If any part is unenforceable, the rest stays in effect. If we publish a new version, it applies only to requests submitted after it is published. The version you accepted is the one recorded with your request.

12. Contact

CompleteTech LLC · complete.tech · 1-844-TECH-WIN · [email protected] · Legal and privacy: [email protected]