How to Check a Website's PHP Version
By PHP Patch Assurance · Last updated: 2026-10-25 · Plain-text version
Checking a website's PHP version means finding out which PHP release its server actually runs, because that version decides whether a flaw like php2shell affects it. On your own server the answer is one command; from outside, a well-run site hides its version, and an honest external check says so instead of guessing.
On the server: php -v
php -v reports the CLI version. That is the starting point, not the whole answer: the CLI and the web SAPI can run different versions, so confirm the web one too — phpinfo() shows the Server API and the version the site actually serves.
In the hosting panel
Most panels show the PHP version assigned to each site. On shared hosting that version is the host's choice, not yours: shared-hosting owners generally cannot patch PHP themselves, which is why shared hosting is the weakest link when a PHP flaw lands. If your panel shows an end-of-life branch, ask the host for its upgrade path.
From outside: headers
Some sites disclose their version in the X-Powered-By header or a phpinfo page. Most well-run sites remove both — hiding the version is good practice, and an exposed phpinfo page is itself a finding worth closing.
The honest external answer
When a site hides its version, an external check cannot tell whether it is vulnerable, and saying so is the correct result. The free scan reports INDETERMINATE in that case rather than guessing — and the read-only deep check, run on the server after ownership is proven, settles it definitively.
Check your site free Patch service
This guide pairs with the free scan.
Frequently asked questions
Why does php -v differ from what the site runs?
Because php -v reports the command-line PHP, while the site runs under a web SAPI — mod_php, PHP-FPM or another — which can be a different version. Always confirm the web SAPI's version.
Is hiding the version enough protection?
No. Hiding the version slows down casual scanning but does not fix anything: the flaw is still there. Patch the version; treat hiding as hygiene, not as a fix.
Can I check someone else's site?
Only what it publicly discloses. The free scan uses disclosure-only fingerprinting — no exploit probes — and reports INDETERMINATE when the version is hidden.