How does this PHP checker work?
To detect PHP version information, this PHP version checker validates the URL and every resolved address, then connects to a verified public IP. A HEAD request reads headers first. If no version is exposed, one GET reads the same page. Only an explicit WordPress generator declaration in that body permits one same-origin /wp-json/ GET. We never infer a PHP release from a WordPress version.
The entire check allows at most four HTTP requests, including one redirect, within five seconds. Every redirect receives the same safety checks. Administrative paths and sensitive files are blocked, including when entered directly. Each body is limited to 512 KiB. A 403 or 429 ends the chain without retrying. Results, including unknown outcomes, are cached for ten minutes.
Evidence records its source, strength, request method, HTTP status, actual URL and limitations. An explicit PHP token in X-Powered-By or Server is strong evidence of a public disclosure. An unversioned PHP header or PHPSESSID cookie name is medium evidence; HTML generator metadata is low evidence. Cookie values and full bodies are discarded.
What do the three results mean?
This does not mean the website is not using PHP. The response may hide its technology or be unavailable. Use one of the six owner-side paths below.
A public clue suggests PHP but does not establish a release. Conflicting version headers also produce this result. Verify the active web handler.
A response explicitly advertises one PHP version. Confirm it on the server before upgrading: headers can be changed, cached or supplied by a proxy.
When you test PHP version compatibility, compare the web runtime with application requirements. A technology fingerprint is an observation, not an inventory of every server behind the domain.
PHP 8.0–8.5 support status
Active branches receive bug and security fixes. Security-only branches receive security fixes; EOL branches no longer receive upstream support. This table helps prioritize an upgrade after verification, but does not tell you which branch a hidden website runs.
| Branch | Active support ends | Security support ends | Status |
|---|---|---|---|
| 8.0 | 2022-11-26 | 2023-11-26 | EOL |
| 8.1 | 2023-11-25 | 2025-12-31 | EOL |
| 8.2 | 2024-12-31 | 2026-12-31 | security only |
| 8.3 | 2025-12-31 | 2027-12-31 | security only |
| 8.4 | 2026-12-31 | 2028-12-31 | active |
| 8.5 | 2027-12-31 | 2029-12-31 | active |
Status basis: (UTC). Sources: php.net supported versions and EOL table. Older active deadlines use the official website’s two-year rule and 8.0.0 / 8.1.0 release dates.
Before upgrading, back up the site, check dependencies and extensions, and test important flows in staging. Keep a rollback path. A platform’s minimum requirement is not a detected version: WordPress recommends PHP 8.3 or newer while documenting legacy compatibility with 7.4+, an EOL branch. Check your exact application release and plugins.
How to check PHP version with server access
Choose the path matching your access. These owner-side checks answer a different question from public detection: which runtime actually executes your application? They remain useful after every result, including a confirmed disclosure.
For a public second opinion, use curl or a browser technology extension. Both depend on visible clues and cannot reveal a deliberately hidden runtime. These are manual alternatives; the checker does not execute them.
curl -I --max-time 5 -- 'https://www.php.net/'01 Open the hosting panel
To find PHP version settings for a domain, open cPanel’s MultiPHP Manager, usually under Software. Select the actual domain and read its active handler. Hosts may rename or hide this interface; ask support if it is unavailable.
02 Read the CMS health report
In WordPress, sign in yourself and open Tools → Site Health → Info → Server. Read the PHP version entry. Our tool never accesses your dashboard. Other content systems may offer a similar authenticated environment report.
03 Inspect the command-line interpreter
Run this on the server or inside the application container. Expect a line beginning PHP followed by a version and CLI details. The shell binary may differ from the web server’s PHP-FPM pool.
php -v04 Use a protected phpversion() script
On a site you administer, first restrict the diagnostic location with web-server authentication and an IP allowlist, or bind it to a loopback interface and use an SSH tunnel. Then run this minimal script through the website’s PHP handler; it prints the interpreter version.
<?php
header("Content-Type: text/plain");
echo phpversion(), PHP_EOL;Delete it immediately after use. Never leave it at a publicly accessible URL. A hard-to-guess filename is not access protection.
05 Inspect protected phpinfo() output
For configuration details, use the same authentication and IP restrictions before creating this script. Its output includes runtime and configuration information that should not be public.
<?php
phpinfo(INFO_GENERAL);Delete it immediately after use. Never leave it at a publicly accessible URL. Do not create this file if you cannot enforce access restrictions first.
06 Check the deployed PHP-FPM service
Inspect the running container image, package inventory and active PHP-FPM pool configuration. Match the pool to the website’s virtual host. A Dockerfile or deployment manifest describes intent; verify the running deployment too, especially after a rollback or partial upgrade.
Frequently asked questions
Can I check PHP version of a website without owning it?
You can inspect a public page without an account, but the result depends on what that response discloses. A website can remove identifying headers or serve a cached page. To find out PHP version details with certainty, ask its operator to verify the active web runtime; do not search for exposed diagnostic files.
Why is the version unknown?
This does not mean the website is not using PHP. Hidden headers, a CDN, an access restriction, or a failed connection can prevent detection. A missing PHPSESSID cookie is not proof either: applications can rename their session cookies. The six owner-side checks above provide a next step without guessing.
Can a “check website PHP version” result prove security?
No. A reported version is a public disclosure, not a vulnerability assessment. Package maintainers may backport fixes, and a proxy may report an unrelated version. Verify the actual package and its maintenance policy, then test upgrades in staging. A hidden version does not establish that a site is secure.
Does “check PHP version of site” cover every server?
No. A check observes one bounded request chain. A load balancer can route different visits to different servers, and subdomains can use separate runtimes. Verify each deployment through its own configuration. Repeated checks of the same normalized URL reuse the ten-minute cache, including results that could not identify PHP.
Is “php show version” a valid terminal command?
No. Use php -v to show the command-line interpreter version. It may differ from the PHP-FPM pool serving the website. A protected phpversion() script reports the runtime executing that script. Delete the diagnostic file immediately after use and never leave it at a publicly accessible URL.
Does the checker follow redirects or probe sensitive files?
It allows one redirect in total, revalidates the destination, and counts that request toward the four-request and five-second limits. It never requests administrative or diagnostic paths. Only a real WordPress generator declaration in the page body can permit one same-origin /wp-json/ request; an article mentioning WordPress cannot.
How fresh is a PHP version check?
A fresh check records its time, request methods, response statuses and inspected URLs. Results expire after ten minutes; refreshing inside that window sends no new target request. HTTP 403 and 429 stop the chain immediately. After changing a server, wait for the cache to expire before checking again.
Read about the project and detection policy or review how submitted URLs and cached evidence are handled. PHP’s phpversion() and phpinfo() documentation explain the diagnostic functions.