Free tool · no signup
What PHP version is this website running?
Paste an address below to see what PHP version the server reports, and whether that release predates the October 2026 security fix. The fix shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026, for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2, Critical). WordPress itself needs no update — the fix comes from your host.
No signup. We load your homepage once — the same single request any visitor makes — and report what it tells us. Nothing else on your site is touched.
This works about one time in twenty. Here is why.
A remote checker can only read a PHP version if the server chooses to print one. We tested twenty WordPress sites: one published a PHP version. Nine published their hosting platform and nothing more. The other ten published nothing at all.
That is not a flaw in the tool, it is hosts doing the right thing. Announcing your exact PHP version tells anyone who asks which attacks to try, so well configured servers suppress it. If this page comes back empty for your site, that is mildly good news.
So here is the method that works every time, with no cPanel, FTP or SSH:
- Log in to WordPress.
- Go to Tools → Site Health.
- Open the Info tab.
- Expand Server. Your PHP version is the first line.
Has your host already patched it?
For most people this is the question that actually matters, because on shared and managed hosting the fix is your host’s job rather than yours. We keep a dated record of what each major host has publicly said, quoted from their own pages — and we say so plainly where we could not find a statement.
See what each host has said →Which PHP versions have the October 2026 fix
| Branch | Fixed in | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Supported, security updates active |
| PHP 8.4 | 8.4.27 | Supported, security updates active |
| PHP 8.3 | 8.3.36 | Supported, security updates active |
| PHP 8.2 | 8.2.35 | Supported, security updates active |
| 8.1 and older | — | End of life. No security updates at all, so no patch level is current. |
Source: the PHP project’s own advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, and the php.net changelog. Last reviewed 2026-10-24.
What this check cannot tell you
It cannot tell you whether your site has been broken into. Nor can any other checker that works from the outside, whatever its marketing says. One page load reveals nothing about your files, your database, your plugins or your user accounts, and that is where a compromise actually lives. The tools that genuinely detect one — Wordfence and Patchstack among them — run installed on the site, which is the whole reason they work that way.
It also cannot confirm that you are patched. CloudLinux, Debian, Ubuntu and Red Hat apply security fixes to older releases without changing the version number, so a server reporting PHP 8.3.8 may already have the fix. Anyone telling you from outside that your site is definitely vulnerable is guessing from a banner.
What it does do is read, from one ordinary request, the things your server volunteers to every visitor: your PHP banner if present, your hosting platform, whether WordPress is in use, whether XML-RPC is advertised, and which of the six common security headers you send. That is a configuration check, and it is a genuinely useful one.
Common questions
How do I check the PHP version of a website?
Paste the address into the checker above. We load the homepage once and read the PHP version from the server response headers, if the server publishes it. Most do not, so if nothing comes back the reliable method is inside WordPress itself: Tools → Site Health → Info → Server shows your PHP version with no cPanel, FTP or SSH access needed.
Why can you not see my PHP version?
Because your host hides it, which is the correct thing for them to do. Publishing your exact PHP version tells anyone who asks which vulnerabilities to try. In a sample of twenty WordPress sites we tested, only one published its version. A blank result here is a good sign about your configuration, not a failure of the check.
Which PHP version fixed the October 2026 vulnerability?
The fix shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026. The advisories are CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 Critical. PHP branches older than 8.2 receive no security updates at all, so no patch level on them is current.
Does WordPress need updating for this?
No. WordPress published on 21 October 2026 that no WordPress update is required or planned for these issues. The flaw is in PHP itself, which is the software your host runs underneath WordPress, so the fix comes from your host or your server administrator rather than from a WordPress update.
My site reports an old PHP version. Is my site vulnerable?
Not necessarily, and anyone who tells you otherwise from outside your server is guessing. CloudLinux, Debian, Ubuntu and Red Hat all apply security fixes to older releases without changing the version number, so a server can report PHP 8.3.8 and already have the fix applied. The version string tells you what was printed, not what was patched. Ask your host, or check your control panel.
Can you tell me if my website has been hacked?
No, and neither can any other checker that works from outside your site. Reading one page tells us nothing about your files, your database, your plugins or your user accounts, which is where a compromise actually lives. Tools that genuinely detect a break-in — Wordfence and Patchstack among them — run installed on the site for exactly this reason.
How do I update my PHP version?
Almost always through your hosting control panel rather than through WordPress. On cPanel it is usually under "MultiPHP Manager" or "Select PHP Version". Managed hosts such as WP Engine, Kinsta and SiteGround have a PHP version setting in their own dashboard. Take a backup first, then move up one minor version at a time and check the site after each step, because very old plugins occasionally break on newer PHP.
Is this check safe to run on a site I do not own?
It makes exactly one request to the address you type — the same single page load any visitor makes — and reads what that response volunteered. It does not request hidden paths, submit anything, try passwords, or attempt to get around a firewall. If a site blocks the request we report that it blocked us and stop.
Want the rest of your site checked?
This page reads one response. A full scan opens your site in a real browser and tests the pages you choose — broken links, forms that submit but never arrive, mobile layout failures, and these configuration findings across the whole site, each with a screenshot showing exactly what we saw. Free for your homepage, no signup.
Run a free scan →Last reviewed . Written and maintained by Waqas Ahmad, a QA engineer with nine years’ experience.