PHP Version Check

Most WordPress, TYPO3 and shop websites run on PHP. If the version is outdated, known security vulnerabilities remain open. If the server also displays the version publicly, it hands attackers exactly the information they need. This check shows you both within seconds.

How to read the result

We read the HTTP headers your server sends with every response, once for the page you entered and once for a page that does not exist. The second request matters: homepages are often served from a cache, while error pages usually run straight through PHP and show the headers unfiltered.

OKThis point is implemented correctly.
ReviewNot an acute error, but room for improvement.
ProblemLikely has a negative effect and should be fixed.
InfoFor information, without rating.

PHP version visibility

Headers such as "X-Powered-By: PHP/8.1.2" reveal the exact version. That is not an error in the strict sense, but it makes automated attacks easier: bots specifically look for servers running a version with a known vulnerability. If nothing is visible, we deliberately show this as a neutral note rather than green, because it says nothing about whether the version is current. Which version is actually running can then only be confirmed by your host.

Support status

Each PHP version is actively developed for two years and then receives security updates only for two more years. Green means active support. Yellow means security updates only, so an upgrade should be planned. Red means no more updates, known vulnerabilities stay open. We update the data daily.

Patch level

Within a version, patch releases appear regularly, for example 8.3.35 to 8.3.36. They fix security issues and can usually be installed without changes to the website. Exception: Linux distributions such as Debian or Ubuntu sometimes apply fixes without changing the version number.

Web server version

Apache, nginx or IIS also often state their exact version in the "Server" header. The same applies as for PHP: the information helps nobody except potential attackers and can be switched off with one line of configuration.

Technology headers found

Finally, we list all headers that reveal details about your technology, such as the CMS in use. Go through the list and check whether each of these details really needs to be public.

Why your PHP version determines your security

PHP powers a large share of all websites, including WordPress. Every new version brings security fixes, more speed and new features. Older versions are eventually no longer maintained, and vulnerabilities discovered after that stay open for good.

In practice, many websites run on the same version for years because nobody keeps track of it. Hosts do provide new versions, but they do not switch automatically because older themes and plugins may break. This creates a creeping risk that only becomes visible once something happens.

An update pays off beyond security, too. Newer PHP versions process requests noticeably faster, which directly affects loading times and therefore user experience and Google rankings. Current versions of WordPress, WooCommerce and many plugins also require a minimum PHP version.

The right order matters: first test a copy of the website on the new version, then switch. That way you avoid your live site suddenly showing an error message.

Hiding version information

# php.ini
expose_php = Off

# Apache (.htaccess or server configuration)
Header unset X-Powered-By
ServerTokens Prod
ServerSignature Off

# nginx
server_tokens off;

Many managed hosting plans let you change "expose_php" in the control panel. "ServerTokens" only works in the server configuration, not in .htaccess. If in doubt, ask your host.

Frequently asked questions about PHP versions

How do I find out which PHP version my website uses if the check shows nothing?

In your host’s control panel, usually under an item such as "PHP settings" or "PHP version". In WordPress you can find it under Tools, Site Health, Info, section "Server".

Is it bad if the PHP version is visible?

Not on its own, as long as the version is current. It becomes critical in combination with an outdated version, because attackers can then see at a glance which vulnerabilities they can exploit. Hiding the information costs nothing and is therefore always recommended.

Can a PHP update break my website?

It can, if the theme or plugins contain outdated code. That is why the update should run in a test environment first. For well-maintained websites, the switch is usually straightforward.

My host says the version is patched, although the check shows an old patch level.

That is possible. Linux distributions such as Debian, Ubuntu or Red Hat apply security fixes to their own packages and leave the version number unchanged. You can often recognise this by suffixes such as "-1ubuntu" in the header. A version branch without official support remains a risk nonetheless.

Where does the support data come from?

We retrieve the official dates for the end of support and security updates as well as the current patch level daily from publicly maintained release information, based on the announcements of the PHP project.

Is my input stored?

We store the checked address and the result anonymously for statistical purposes. Your IP address is not stored. More in our privacy policy.

See all 35 tools

Security Headers Check
Checks which protective headers your server sends: HTTPS, HSTS, CSP, framing protection, cookies. With a grade and a snippet.
WordPress Security Check
Finds common weaknesses such as exposed usernames, outdated versions and public error logs.
CMS Detector
Shows which system a website runs on, whether the version still receives security updates and, for WordPress, which plugins are outdated or vulnerable.
Speed & Hosting Check
Measures load time with Google PageSpeed and shows where your website is hosted, when certificate and domain expire and who runs your e-mail.

PHP updates without the risk

We check your website for compatibility, test the update in a safe copy and only switch once everything works. On request, we also take care of ongoing maintenance so the topic does not fall asleep again.

Get in touch