PHP Version Checker Online

Last updated:

Check whether a website publicly exposes a PHP version. See the exact signal, the URL and response tested, evidence strength, lifecycle context, and what to verify next.

Paste a public URL to check whether its response exposes a PHP version:

How the Online PHP Version Checker Works

This tool checks public response signals for an exact PHP/version token. It cannot inspect the private runtime configuration. Here's the process:

  1. Submit the page you care about. The checker keeps that path and may try its HTTP/HTTPS and www/non-www variants. It does not probe admin pages or other common paths.
  2. Inspect bounded public evidence. It sends HEAD, then GET when needed, checks X-Powered-By and Server, and reads at most the first 512 KB of the response body.
  3. Review the evidence. The result shows the exact signal, request method, HTTP status, response URL, support phase, and limitations. A body mention is explicitly not treated as runtime proof.

"Not detectable" means the checked responses did not expose a supported signal. It does not mean the website is not using PHP.

Why Check Your PHP Version?

PHP powers WordPress, WooCommerce, Drupal, Laravel, and many custom applications, but well-configured production sites commonly hide runtime version headers. This check is most useful as a quick external observation or a way to spot accidental version disclosure.

PHP's official lifecycle separates active support, security-fixes-only support, and end of life. The PHP project urges users of unsupported branches to upgrade because later releases may contain security and bug fixes they do not receive. A version signal alone does not establish whether the site is patched, secure, or compatible with a newer branch. Run a security headers check for a separate set of public HTTP observations.

If you plan to change PHP, measure your own application before and after on production-like staging. Runtime performance depends on the application, extensions, cache, database, server configuration, and workload. Use our performance checker for public page measurements, not as a substitute for server-side profiling.

If you're running a WordPress site, we've written detailed guides on which PHP version to use and which PHP extensions WordPress needs. You can also inspect publicly exposed WordPress version clues, use the WordPress Theme & Plugin Detector to review visible theme and plugin evidence, or check a site's public technology signals for a broader external inventory.

Setting up or hardening a WordPress install? Our wp-config.php generator builds a secure configuration baseline, and the WP REST API exposure checker flags whether your site is leaking user data through the REST API.

Tired of chasing PHP versions altogether? A static Astro website has no PHP, no plugins, and no database to maintain, just clean HTML that loads in under a second and is easy for AI engines to cite. If you're on WordPress, our WordPress to Astro migration services rebuild your site without losing your rankings.

PHP Version Support Timeline

The lifecycle below reflects PHP's official supported-versions and end-of-life tables as of 2 September 2026. It avoids volatile point-release and CVE totals; use the linked PHP sources for current release notices and security information.

PHP branch support status as of 2 September 2026
Branch Status Active support until Security support until
PHP 8.0 End of life — 26 Nov 2023
PHP 8.1 End of life — 31 Dec 2025
PHP 8.2 Security fixes only 31 Dec 2024 31 Dec 2026
PHP 8.3 Security fixes only 31 Dec 2025 31 Dec 2027
PHP 8.4 Active support 31 Dec 2026 31 Dec 2028
PHP 8.5 Active support 31 Dec 2027 31 Dec 2029

PHP provides regular bug and security fixes during active support, then critical security fixes only during the security-support window. After end of life, the PHP project no longer supports the branch. Dates: PHP supported versions and unsupported branches.

PHP 8.0 and 8.1 are unsupported, while 8.2 and 8.3 receive critical security fixes only. Do not select a target branch from this table alone. For WordPress, review our recommended PHP version guidance and test the exact site on staging.

How to Verify the PHP Version You Actually Control

Use this public checker as a lead, then confirm the environment that serves the application:

  • WordPress: open Tools → Site Health → Info → Server. WordPress documents Site Health as the dashboard view for server and PHP configuration information.
  • cPanel or another host panel: inspect the PHP selector or domain runtime setting for the exact production domain. A server-wide default may differ from a site-specific setting.
  • Command line: run php -v to identify the CLI SAPI. PHP documents CLI as a separate SAPI, so do not assume that its binary or configuration matches PHP-FPM, Apache, or another web SAPI.
  • Production and staging: check both. Also confirm scheduled jobs and workers when they use separate commands or containers.

Need to answer "will my WordPress site work after the change?" This detector cannot answer that. Use the WordPress PHP Upgrade Readiness Checker to inventory core, theme, plugin, and custom-code evidence, then run its staging test plan.

Primary references: WordPress Site Health documentation plus PHP's command-line SAPI documentation and -v option reference.

Next steps

Online PHP Version Checker related tools and articles

Continue with the closest follow-up checks and guides based on this tool's topic, crawl intent, and optimization workflow.

PHP Version Checker: FAQ

Which public signals does the PHP checker use?
It looks for an exact PHP/version token in X-Powered-By, then Server, then the first 512 KB of a GET response body. X-Powered-By is labelled strong public-header evidence, Server is moderate, and a body mention is low-confidence context rather than proof of the runtime.
Why does the result say Not detectable?
Most production sites hide runtime versions, and a CDN, proxy, cache, or security layer can strip them. The site may also use a different runtime. Not detectable means no supported public signal was found, not that PHP is missing or unsafe.
What do confidence and evidence mean?
The evidence label describes where the exact token appeared; it is not a probability. Even a strong X-Powered-By header is a public claim for one response and does not prove which PHP binary handles every route, worker, cron job, or server behind a proxy or load balancer.
Can a detected version be stale or misleading?
Yes. A proxy can expose an old header, a cached page can contain a version string, and body text can mention PHP without identifying the runtime. Treat moderate and low-confidence results as leads, and verify even strong header evidence before making an upgrade decision.
How should I verify the version on a site I own?
For WordPress, use Tools, Site Health, Info, Server. In cPanel or another hosting panel, check the PHP selector for the exact domain. On a shell, php -v identifies the CLI runtime only; PHP's CLI and web server SAPIs can use different binaries or configuration, so confirm the web runtime separately. Check production and staging independently.
Does this PHP version detector test WordPress compatibility?
No. It checks only public version signals. It does not inspect WordPress core, themes, plugins, extensions, custom code, or staging behavior. Use the WordPress PHP Upgrade Readiness Checker to inventory compatibility evidence and build a test plan before changing PHP.
What should I do if the verified version is unsupported?
Back up the site, clone or use staging, check CMS, theme, plugin, extension, and custom-code compatibility, then upgrade and test critical pages, forms, checkout, jobs, and integrations. Keep a documented rollback path.
Why might a repeated check show a cached result?
Results are cached in server memory for 10 minutes by normalized URL, and the response indicates whether it was cached. Serverless instances may not share that memory, so caching behavior can vary. Wait or verify directly when testing a recent server change.
What data is sent and retained by this checker?
The submitted public URL is sent to Web Aloha's server, which may try HTTP, HTTPS, www, and non-www variants of that exact path with HEAD and GET requests. The normalized URL and result can remain in an in-memory cache for up to 10 minutes; the endpoint does not store page bodies in a database.

Free 48-Hour Website Audit

Not sure what to fix first on your own website? We'll review it and tell you, in plain English. Free & non-obligatory.

Need Help With Your PHP Stack?

We help small-to-medium businesses keep their websites secure, fast, and up to date.