Skip to main content

Free tool

PHP version checker: is your website on a supported PHP?

Enter your website address and get a report in under ten seconds: the PHP version if your server shows it, whether that version still gets security fixes, and whether it is exposed to php2shell, the critical flaw disclosed on October 21, 2026. The same report goes to your inbox.

We email you the report and may follow up about it. No spam, no sharing.

What we check

  • The PHP version your server reports, when it reports one
  • Whether that version is supported, security-fixes-only, or end of life, with the official dates
  • Exposure to php2shell (CVE-2026-109618 and CVE-2026-109619) and CVE-2024-4577
  • The platform behind the site: WordPress, Laravel, Drupal, Joomla, Magento, WooCommerce
  • HTTPS and the HSTS, CSP, X-Frame-Options and X-Content-Type-Options headers

We make one normal request to your homepage. We never log in, scan ports or change anything on your site.

PHP version checker questions

What does the PHP version checker do?

It reads what your website shows publicly, such as response headers and page code, to find the PHP version and the platform behind the site. It then compares that version with the official PHP support dates and tells you whether it is current, behind, or vulnerable.

Why does the PHP version of my website matter?

PHP runs your website on the server. Once a version reaches end of life, the PHP team stops publishing security fixes, so new flaws stay open. Plugins, themes and hosting providers also drop old versions, which makes a late upgrade slower, riskier and more expensive.

How does the checker find my PHP version?

The main source is the X-Powered-By header, which many servers still send. We also look at cookies, links to PHP files, the Server header and fingerprints of platforms such as WordPress or Laravel. We make one normal request to your homepage and never log in or change anything.

What if the result says the PHP version is hidden?

Hiding the PHP version is common and good practice, so it is not a problem in itself. It does mean nobody outside can confirm the version is patched. Your hosting control panel shows the exact version, or you can ask us to confirm it for you.

What is php2shell and does it affect my site?

php2shell is our name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution without logging in. They were disclosed on October 21, 2026. Any PHP site that has not updated since then, or runs PHP 8.1 or older, is exposed.

How often should a business upgrade PHP?

Apply patch releases as soon as they ship, usually within days, because they carry security fixes. Move to a new PHP branch about once a year, before your current branch loses security support. Planned yearly upgrades are small, while a forced upgrade after end of life is large.

Need the upgrade done?

We upgrade PHP sites at a fixed price and test them before anything goes live.

Book a free call

Or pick a time right here

Loading the calendar…

Open the booking page

30 minutes on Google Meet, free. Times shown in your local timezone.

Book a free call