About PHP Version Checker
PHP Version Checker is a free, read-only tool for site owners, WordPress users, agencies, and hosting teams. Paste a public URL and it reports the PHP version a site exposes, the branch support status, and whether the site is patched against PHP2Shell.
Why this site exists
A quick answer when the version is hidden
The PHP version behind a website matters for security and compatibility, but it is often invisible. Many hosts disable expose_php, put a CDN in front of the origin, or run PHP-FPM without adding version headers. Site owners may not have SSH access, and a client asking “which PHP version are we on?” should not require a support ticket.
The checker gives a first answer from public data. When the version is hidden, it does not guess: the result explains why and shows a 30-second self-check path using the command line, a temporary PHP file, cPanel, Plesk, XAMPP, or WordPress Site Health. The same page links to the official advisory and support dates so the answer can be verified.
The site was built around PHP2Shell, the pair of critical PHP vulnerabilities fixed on 21 October 2026, but it is not limited to that incident. PHP branch end-of-life dates and WordPress minimum requirements are part of the same question: is this site running software that still receives fixes?
How it works
Three steps, no scanning
The checker is deliberately small. It does not crawl a site, run a vulnerability scanner, or ask for access to the server.
Validate the target
The checker only accepts public HTTP and HTTPS addresses on ports 80 and 443. It rejects private and reserved networks, resolves hostnames with Cloudflare DNS-over-HTTPS, and re-checks every redirect.
Read public responses
It sends ordinary HEAD and GET requests to public pages. It reads response headers, PHPSESSID cookies, and the first 500 KB of the homepage to detect PHP and WordPress. It never sends POST requests or probes for vulnerabilities.
Compare official data
Detected versions are compared with PHP support dates from endoflife.date and the first patched releases from php.net. WordPress minimum requirements come from the core version file.
Data sources
Official data, linked for verification
Version detection is only useful if the comparison data is current. The checker uses the PHP project’s advisory, the endoflife.date API, and WordPress core files. The page for each result links back to the source so you can confirm the details.
What the result can and cannot tell you
- The PHP version a public response exposes, and whether it is at or above the first official PHP2Shell fix.
- The PHP branch support status and the security-support date from endoflife.date.
- Whether WordPress, a WordPress version, and an inferred minimum PHP requirement are visible on the homepage.
- It cannot see a hidden version, a distribution backport that did not change the version string, or the security of the application, plugins, and configuration.
Confidence labels describe the detection evidence, not the overall security of the site. High confidence means a version came from a direct header; it does not mean the site is safe.
Privacy
No account, no query history
The checker does not require an account and does not maintain a database of the URLs you submit. Client IP addresses are used transiently for rate limiting through Cloudflare; the application does not store a query history. Your light or dark theme preference is kept in your browser’s localStorage and is not sent to the server.
When you check a URL, the server sends a request to that website. The target site may log the request, including the checker’s outbound IP address and User-Agent, under its own privacy policy. Read the full privacy policy for details.
Independence
An independent tool
PHP Version Checker is not affiliated with the PHP Group, WordPress, Cloudflare, or any hosting provider. PHP, WordPress, Cloudflare, and other product names are trademarks of their respective owners, used here for identification only.
Data is attributed to its source. If an official advisory or lifecycle date changes, the underlying data files and pages can be updated independently of the checker’s logic.
FAQ
About the checker
What the tool does, what it stores, and what it cannot see.
Ready to check a site?
It takes a few seconds and does not require an account.