A PHP scanner may show an old version after an update because the visible version and evidence of an installed fix are different pieces of information.
You have had an update installed and run another check, but the same warning appears. That is a reason to discuss the result with your administrator. First establish which information the scanner read.
Then compare the measurement with the evidence for the change. Close the warning only when you understand what both results establish.
Save a copy of the warning with its date and the domainA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted. checked. Record which tool you used. Give those details to the administrator along with their earlier update confirmation.
This helps them assess whether the measurement and the change concern the same website, rather than trying to explain an isolated version number.
An older base can receive a backported fix
A backportA backport takes a fix made for a newer version of software and applies it to an older version, so the old one gets the fix without a full upgrade. applies a repair to an older version. Our facts source says some distributions and LTS vendors provide backported fixes. The existence of those packages does not prove the state of your installation.
Ask which package edition your administrator uses and which documentation describes its contents.
A distribution can keep the original PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. number in a patched package. A check that sees that version may therefore still describe the installation as old. Request the complete package details to move the review forward.
A general statement that scanners sometimes do this does not establish what was checked on your server.
Have the administrator confirm that the identified installation serves your domain. Keep that confirmation with the update date. A general explanation of backports makes the warning easier to understand, but does not complete your own review.
For that you need an answer tied to this website and this package edition.
What the Exposure Check reads
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
For the PHP version, the Exposure Check reads what your website sends publicly in headers. Headers are information sent with the website’s response. The term X-Powered-ByX-Powered-By is a hidden label a website can send along that tells anyone who asks which software it runs, such as PHP/8.1. explains one possible headerAn HTTP header is a short line of extra information that a browser and a website send each other with every page request, invisible to the visitor..
The check does not request administration access or read the server’s package records. Its result concerns the information available from outside.
A patched server can therefore still show an old version in the check. Use the result to start a conversation with the administrator. Ask which public version was seen and which package runs behind it.
The check and the package evidence answer different questions. Compare those answers before deciding whether the repair has been demonstrated.
If no useful version appears, still request the installation details. Do not treat an absent version as confirmation that the fix is installed. The same applies to a reassuring number: ask for underlying evidence when you need to establish the package state.
An external check cannot replace that review of the installation.
Hiding version headers is not a fix. Removing X-Powered-By or disabling expose_php hides information but does not repair PHP2Shell. You still need evidence of the installed fix.
Collect evidence for the update
Request the full package name and version, its source and the relevant changelog entry. Have the administrator explain the connection to the repair. Read how to check a PHP packageTo check a PHP package, compare the installed package version with its record of changes and confirmation from the administrator of your website. for questions to use.
If a reference is missing, record exactly which evidence still needs to be provided.
Also ask what was checked after the change. Which website was opened and which functions were tested? Who confirmed that the changed installation is serving your domain?
Keep these questions separate from the public header. They concern the actual change and use of the site, rather than only the result of a measurement.
Check the security status for the recorded facts. Ask the administrator which questions their package evidence can answer. Do not turn confirmation of one repair into a conclusion about every possible issue.
Describe the result as precisely as the evidence allows, and leave any unanswered questions visible in the record.
When the scanner and administrator disagree
Send the measurement back with a short question: how does this public version relate to the package details you provided? Request a written answer that another person can follow. An instruction to ignore the warning is not enough to complete the review.
Ask for the explanation and the evidence behind it.
If the answer remains unclear, discuss further investigation or another maintenance route. Use the hosting guides to find your current settings. Check supported PHP versions when discussing an upgrade.
Ask your administrator for a workable upgrade plan and the checks needed to assess that move.
Keep both the original warning and the response. Agree when outstanding questions will be followed up. Tell the website owner what has been demonstrated and what still needs investigation.
This keeps the package question visible even if the warning is later dismissed or the next scan produces a different result.
Not sure which route fits?
Start with the PHP Exposure Check and save its result. Then use the help form with your domain and the host’s confirmation. Explain that a check still reports an old version after an update.
Do not send passwords or complete server files. Start with the specific disagreement that needs checking.
Frequently asked questions
Why does my PHP scanner show an old version?
A patched distribution package can retain its older PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. base. Ask the administrator to compare the visible version with package evidence for your website.
Does the Exposure Check prove PHP is patched?
No. For the PHP version, it reads public headers. Evidence for a package fix requires installation details and supporting documentation from your administrator.
Should I ignore a PHP warning after an update?
Request an explanation backed by evidence first. Keep the question open if the administrator cannot establish which package serves your domain.