Skip to content
PHP Version Checker
Passive, read-only checks

PHP Version Checker

Find out which PHP version a website runs, whether that branch is still supported, and whether it is patched against PHP2Shell — in seconds.

Try an example:

Free · No sign-up · We never store the URLs you check

Example result

example.com

sample

Patched and supported

PHP 8.3 branch · PHP2Shell fix applied

PHP version
8.3.42
Branch
8.3
Support
Security fixes only
PHP2Shell
Patched (8.3.36+)

X-Powered-By: PHP/8.3.42

Set-Cookie: PHPSESSID=…

Illustrative data — not a real check.

Read-only. Public HEAD and GET requests only

No account. Open the page and check a site

No history. We do not log submitted URLs

How it works

Three passive signals, one clear answer

This free tool lets you check a website's PHP version without access to the server. It looks at signals that a public site already sends to every visitor. Nothing is installed, nothing is guessed silently, and every result shows the evidence behind it.

Enter a public URL
The checker normalizes the address, accepts only HTTP and HTTPS on ports 80 and 443, and rejects private or reserved network targets before a request is sent.
Read public responses only
It sends a HEAD request, falls back to GET when needed, and reads the X-Powered-By and Server headers, PHPSESSID cookies, and the first 500 KB of the homepage.
Match official lifecycle data
The detected version is compared with PHP's published support windows and the PHP2Shell fix versions. If the version is hidden, the result says so instead of guessing.

Reading the result

What your result means

The result card uses three colors. Here is what each one means and what to do next.

Patched and supported
The exposed version is at or above the first official PHP2Shell fix in its branch, and the branch still receives security updates.
Cannot determine
The version is hidden, ambiguous, or carries a distribution suffix. A Linux package may include a backported fix without changing the version string, so the checker does not guess.
Vulnerable or end of life
The detected version is older than the official PHP2Shell fix, or the branch no longer receives security patches. Upgrade to a supported branch.

A missing version is normal

Why the checker sometimes cannot find a PHP version

Many production servers deliberately remove version information. That is a sensible hardening step, but it means a passive checker cannot always identify the PHP release behind a site.

When the version is hidden, the checker does not guess. It shows a 30-second self-check panel with commands and control-panel paths for the server owner. If you run the site, that panel is the fastest way to get a definitive answer.

How to check PHP versionPHP end-of-life datesWordPress PHP version

Common reasons

  • expose_php is turned off

    Setting expose_php = Off in php.ini removes the X-Powered-By header. Many hosts enable this by default.

  • A CDN or proxy strips headers

    Cloudflare, nginx proxies, and load balancers often remove or rewrite upstream server headers.

  • PHP-FPM adds no version header

    FastCGI and PHP-FPM setups usually do not append X-Powered-By unless the application does it.

  • The page is served from cache

    A cached homepage may be returned without passing through PHP at all, so no PHP signal is visible.

Security advisory

PHP2Shell: what this checker looks for

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. PHP released official fixes on 21 October 2026. The checker compares a detected version with the first patched release in each branch.

Branches 8.1 and older are end of life and have no supported release. The PHP project published minimal source backports for 7.4, 8.0, and 8.1, and some distributions provide patched packages. Distribution builds with suffixes such as -1ubuntu2.19 are reported as cannot determine, because the package may already include a backport.

Read the PHP2Shell guide
First officially patched versions
First officially patched PHP versions for PHP2Shell
PHP branchFirst fixed release
8.58.5.12
8.48.4.27
8.38.3.36
8.28.2.35
8.1 and earlierNo supported release
Source: php.net security advisory. PHP 8.1, 8.0, and 7.4 have minimal source backports, and some distributions ship patched packages. There is no supported release for 8.1 or older. Always confirm the current advisory before acting.

FAQ

Frequently asked questions

Short answers to the questions site owners ask most about checking a PHP version.