Free PHP Exposure Check: which PHP version does your site run?
Enter your site address. We read only public headers and the top of your homepage, like a browser, never log in and never scan for weaknesses.
What the check does and does not do
It is passive by design. It reads what your server already tells every visitor, and nothing more. If the version is hidden, we say so instead of guessing.
Why the version matters
Sourced facts, checked on October 21, 2026.
- php.net, 21 Oct 2026PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. 8.2 gets security fixes onlySecurity support is a phase in which a PHP version only gets fixes for security problems. Ordinary bugs are no longer repaired. until Dec 31, 2026, and PHP 8.3 until Dec 31, 2027.
- W3Techs, 21 Oct 2026According to W3Techs (October 21, 2026), 34.8 percent of websites that use PHP run PHP 7, 5 or 4.
- php.net, 21 Oct 2026PHP 8.4 and 8.5 are in active supportActive support is the phase in which a PHP version is fully looked after: both ordinary bugs and security problems get fixed, with regular updates., until Dec 31, 2026 and Dec 31, 2027.
The check is free. Fixing is up to you.
The check costs nothing and creates no obligation. From-prices excluding VAT; the final price follows in writing before work starts.
- Exposure CheckFreePassive check of headers and version. No login, no scan.
- Fix or upgrade$425From $425. PatchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem., update, migrate or rebuild, with a starting price up front.
Related pages
- Supported PHP versionsWhich versions get fixes right now
- PHP updateMove to a supported PHP version
- PHP migrationMove to a modern stack and host
- Explained in plain languagePHP2Shell without jargon, in five minutes
Terms on this topic, explained
- X-Powered-ByX-Powered-By is a hidden label a website can send along that tells anyone who asks which software it runs, such as PHP/8.1.
- Security headersSecurity headers are hidden instructions your site sends with each page that tell the visitor's browser which protections to switch on.
- cURLcURL is a tool that lets software, such as PHP, fetch information from other websites and services, for example to check for updates or send an order.
- Content Security Policy (CSP)A Content Security Policy (CSP) is a rule your site sends to browsers that lists where scripts, styles and images on a page may come from. All else is blocked.
- Domain
- Check
- Result
- Report
We are checking
We only read what your site already sends in public. This takes a few seconds.
- Looking up the domain
- Connecting to your site
- Reading the headers
- Identifying the platform
- Identifying the CDN or firewall
Adds platform, firewall or CDN, hosting and your previous scan. We add your result to the form. A person replies within 1 business day.
Details
- Website
- PHP
- PHP version
- Checked
Headers we looked at
What this does not tell you
Read how to find your PHP version yourself
Ask your hosting provider
Copy this question and send it to your hosting provider or developer. You do not need to give us an email address for this.
Which PHP version does this website use, and how do I check that in my hosting panel?
Where should we send your report?
You see the report below. The email version, ready to forward to your web developer, follows.
Your full report
- Website
- PHP
- PHP version
- Platform
- Firewall/CDN
- Hosting
- Previous scan
We add your result to the form. A person replies within 1 business day.