Released

Howdah 1.3.0 is released — Layer 1 (request-shape limits) plus Layer 2 (input inspection, log-only). Howdah starts in detect mode: the critical limits block, everything else only logs. Read the coverage table for exactly what has been tested on your PHP version before you switch rules to block.

Howdah

Home / Demo

Try Howdah in your browser

Pick a sample request and see Howdah's verdict. This runs the real Howdah core, compiled to WebAssembly, right here in your browser — nothing is sent to any server, and this is not a scan of your site.

Sample request (benign; shape only)

The WebAssembly core (~430 KB) loads when you first run a sample. Default configuration: block mode.

Verdict

Choose a sample and select Run to see what Howdah does.

The samples recreate only the harmless structure of each request — counts and sizes, never a working exploit. The verdict, rule name and reason come straight from the same core that ships in the extension.