How to Check Your Website's PHP Version (7 Ways, No Developer Needed)

As of 23 October 2026, the PHP2Shell flaws are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so knowing your exact PHP version is the first step to knowing whether your site is exposed. The fastest way for most owners is to look in WordPress Site Health or the hosting control panel, or to ask the host. Server admins can use the command line or the package manager.

One warning before you start. Many Linux servers get security fixes from their distribution, and those fixes keep the old version number. A server can show "PHP 8.3.6" and be fully patched. So the version number tells you which branch you are on, but on many servers only the package version, the changelog or your host can confirm the PHP2Shell fix is installed.

Below are seven ways to check, from easiest to most technical, then how to read what you find.

1. WordPress Site Health

If your site runs WordPress, you can see the PHP version without touching the server. According to the WordPress Site Health documentation, the screen "is located in your dashboard under Tools > Site Health > Info."

1. Log in to your WordPress dashboard as an administrator.
2. Go to Tools > Site Health, then open the Info tab.
3. Expand the Server section. WordPress says it "shows information about your server architecture, web server, various PHP variables."
4. Write down the PHP version exactly as shown, including every number after the dots.

The Status tab may also warn that "Your site is running an outdated version of PHP, which requires an update." That warning is about general support status, not PHP2Shell. A distro-patched server can trigger it, and a vulnerable one can avoid it. For the bigger picture on WordPress and PHP, see our WordPress PHP versions guide.

2. Your Hosting Control Panel

Most shared and reseller hosting gives you a panel where you choose the PHP version per site.

cPanel

In cPanel, open MultiPHP Manager in the Software section. cPanel's MultiPHP Manager documentation says the list shows "The PHP version that the domain currently uses," with an "Inherited" label when a domain uses the server's default. Your host can hide this tool, so if you don't see it, ask them.

cPanel usually shows the branch, such as PHP 8.3, rather than the patch release. On cPanel servers the patched builds come from EasyApache 4 packages (ea-php), so the host needs to confirm those packages are updated.

Plesk and other panels

Plesk and other panels also let you set PHP per domain, usually in the domain's PHP settings. Menu names vary by version and host, so if you can't find it, ask your host's support team. Like cPanel, these screens usually show the branch, not whether the PHP2Shell fix is installed.

3. Ask Your Host (Template Message)

For most business owners, this is the most reliable check. The host knows where its PHP comes from and whether it has applied the fix. ENISA's joint statement tells organizations to "coordinate with hosting and service providers, and apply the released security updates." Copy and adapt this message:

Subject: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) status for [your domain]

Hello, please confirm the following for [your domain]:
1. Which PHP version and build serves this site, and where it comes from (php.net release, Linux distribution package, or control panel package)?
2. Is the fix for CVE-2026-109618 and CVE-2026-109619 installed? Please give the package version or advisory number.
3. Have all PHP workers (PHP-FPM, Apache) been restarted since the fix was installed?
4. If the site is on PHP 8.1 or older, is a vendor backport installed, and when can we move to a supported version?
Thank you.

A good answer names a version and a source, such as "PHP 8.3.36" or "Ubuntu package 8.3.6-0ubuntu0.24.04.13." A vague "we're on the latest" is worth a follow-up question. Who is responsible for what depends on your hosting type; our guide to the shared responsibility model explains the split.

4. The Command Line (php -v)

If you have SSH access, the quickest command is:

php -v

It prints the PHP version of the command-line program. The important caveat comes from watchTowr: "The command-line php binary can be a different version from the one PHP-FPM or Apache runs." Servers often have several PHP versions installed side by side, and the one your website uses may not be the one your shell finds first.

AlmaLinux adds a second warning for its own packages: "Don't rely on php -v: our fixes are backported, so the upstream PHP version number doesn't change." Use php -v to learn the branch, then confirm the build with method 7 below.

5. A Temporary phpinfo() Page

watchTowr recommends checking "the PHP version that actually serves web requests, using phpinfo() output or your package manager." A phpinfo page shows what the web server's PHP reports, which avoids the command-line mismatch.

1. Create a file in your site's web folder with a random, hard-to-guess name ending in .php.
2. Put one line in it: <?php phpinfo();
3. Open that file's address in your browser and note the PHP version at the top and the Server API line, which shows how PHP is connected to the web server.
4. Delete the file immediately.

Deleting it matters. The PHP manual for phpinfo() says it outputs "the PHP version, server information and environment," paths, configuration and HTTP headers, and that it "contains all EGPCS (Environment, GET, POST, Cookie, Server) data." Left online, it hands attackers a map of your server. And on a distro-patched server, phpinfo shows the same unchanged upstream number as php -v.

6. Response Headers (X-Powered-By)

Some servers announce their PHP version in an HTTP response header. The PHP manual for expose_php says this setting "Exposes to the world that PHP is installed on the server, which includes the PHP version within the HTTP header (e.g., X-Powered-By: PHP/5.3.7)." You can see headers in your browser's developer tools (Network tab) or with a command such as:

curl -I https://www.example.com (replace with your own address)

Read the result with care:

• Many hosts turn this header off. php2shell.com suggests expose_php = 0 as "optional hardening" that "does not remediate PHP2Shell." A missing header proves nothing.
• A header that is present shows the upstream number, which on distro-patched servers does not reflect the fix.
• Caches, CDNs and proxies can remove or rewrite headers.

Treat headers as a hint about the branch, never as proof that you are safe.

7. The Package Manager (the Real Proof on Linux)

On servers that use Linux distribution packages, the installed package version is what shows whether the fix is in. Debian's security FAQ says you can confirm a fix "by looking at the package changelog, or comparing its exact version number with the version indicated in the Debian Security Advisory."

Ubuntu and Debian

dpkg-query -l 'php*'
apt-get changelog php8.3-fpm (example: replace 8.3 with your version)

Compare the installed version with the "Fixed in" version in the vendor notice. For example, Ubuntu's USN-8948-1 lists php8.3-fpm 8.3.6-0ubuntu0.24.04.13 as fixed on Ubuntu 24.04 LTS.

AlmaLinux, Red Hat and similar

rpm -q php-common

The AlmaLinux PHP2Shell post says to compare this "against the patched package versions," and to use rpm -q php8.4-common for PHP 8.4 on AlmaLinux 10. Red Hat users can match the package against the RHSA advisory for their release.

If PHP came from a control panel, a third-party repository or a container image, the operating system's packages may not be the ones serving your site. Ask whoever provides that PHP.

How to Read What You Found

Compare your result with our PHP2Shell fixed versions table. This summary covers the common cases as of 23 October 2026.

If you can't patch right away, our guide to PHP2Shell interim mitigations covers the settings PHP recommends to reduce exposure. They are a stopgap, not a fix.

What If Your Site Does Not Use PHP?

PHP2Shell only affects servers that run PHP to serve web requests. Hosted platforms such as Shopify, Wix and Squarespace run their own infrastructure, and static sites don't run PHP at all. If you aren't sure what powers your site, our plain-English guide to PHP2Shell explains who is and isn't affected, and our overview of hosting types helps you work out who manages your server.

Conclusion

As of 23 October 2026, checking your PHP version takes a few minutes in WordPress Site Health, your control panel, or a message to your host. The harder part is proving the fix is installed, because distribution packages keep old version numbers. Use the package version, the vendor notice or your host's written confirmation, and make sure PHP was restarted after the update. If you'd rather have someone check and patch it for you, our emergency PHP patching service can help. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions