From address to page
A visit starts with a domain nameA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted.. DNSDNS is the internet's phone book: it looks up a domain name, such as yourcompany.com, and tells browsers which computer holds that website. translates that name into the address of the server that hosts the site. An SSL/TLS certificateAn SSL/TLS certificate proves your website is really yours and scrambles the data between visitor and site. It shows as HTTPS and a padlock in the address bar. proves the site is who it says it is and encrypts the connection, which is why the address bar shows HTTPS.
Then browser and server talk. Each request and each response carries an HTTP headerAn HTTP header is a short line of extra information that a browser and a website send each other with every page request, invisible to the visitor. or several, and each response comes with an HTTP status codeAn HTTP status code is a three-digit number a website sends back with every page request to say how it went, such as 200 for OK or 500 for an error.: 200 when all is well, 500 when the server ran into an error it could not handle. Server-side code such as PHP can also fetch data from other servers itself, usually through cURLcURL is a tool that lets software, such as PHP, fetch information from other websites and services, for example to check for updates or send an order..
Headers that reveal or protect
Some headers give away more than you would like. X-Powered-ByX-Powered-By is a hidden label a website can send along that tells anyone who asks which software it runs, such as PHP/8.1. can tell anyone which PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. your server runs. Other headers do the opposite and add protection: security headersSecurity headers are hidden instructions your site sends with each page that tell the visitor's browser which protections to switch on. tell the browser to use HTTPS only or limit which scripts may run, with the Content Security PolicyA Content Security Policy (CSP) is a rule your site sends to browsers that lists where scripts, styles and images on a page may come from. All else is blocked. as the strongest example.
Why these basics matter for PHP
Most PHP problems show up first in these basics. A broken upgrade often surfaces as a status code 500 instead of your homepage. An expired certificate or an old cURL library can stop PHP from talking to payment providers or update servers. And a header that names your PHP version tells every scanner on the internet what to try. Knowing these terms makes it easier to describe a problem, and quicker to fix it.
Check what your site shows
You can see a lot of this from the outside, without logging in anywhere. With our free tool you can check your PHP version: it reads the public headers of your site and tells you whether a PHP version is visible. If it turns out your site runs an old branch, we update PHP in WordPress by moving it to a supported version, with a test on stagingA staging environment is a private copy of your website where you try updates first, so any mistakes happen there and not on the live site. first.