# How to Check a Website's PHP Version

By PHP Patch Assurance · Last updated: 2026-10-25

Checking a website's PHP version means finding out which PHP release its server actually runs, because that version decides whether a flaw like php2shell affects it. On your own server the answer is one command; from outside, a well-run site hides its version, and an honest external check says so instead of guessing.

## On the server: php -v

`php -v` reports the CLI version. That is the starting point, not the whole answer: the CLI and the web SAPI can run different versions, so confirm the web one too — `phpinfo()` shows the Server API and the version the site actually serves.

## In the hosting panel

Most panels show the PHP version assigned to each site. On shared hosting that version is the host's choice, not yours: shared-hosting owners generally cannot patch PHP themselves, which is why shared hosting is the weakest link when a PHP flaw lands. If your panel shows an end-of-life branch, ask the host for its upgrade path.

## From outside: headers

Some sites disclose their version in the `X-Powered-By` header or a phpinfo page. Most well-run sites remove both — hiding the version is good practice, and an exposed phpinfo page is itself a finding worth closing.

## The honest external answer

When a site hides its version, an external check cannot tell whether it is vulnerable, and saying so is the correct result. The [free scan](/scan) reports INDETERMINATE in that case rather than guessing — and the read-only deep check, run on the server after ownership is proven, settles it definitively.

## Frequently asked questions

### Why does php -v differ from what the site runs?

Because php -v reports the command-line PHP, while the site runs under a web SAPI — mod_php, PHP-FPM or another — which can be a different version. Always confirm the web SAPI's version.

### Is hiding the version enough protection?

No. Hiding the version slows down casual scanning but does not fix anything: the flaw is still there. Patch the version; treat hiding as hygiene, not as a fix.

### Can I check someone else's site?

Only what it publicly discloses. The free scan uses disclosure-only fingerprinting — no exploit probes — and reports INDETERMINATE when the version is hidden.