How to Find Your Site's PHP Version (If Hidden or Masked)
Self-Check Guide
Because hiding PHP version headers via expose_php = Off is recommended security practice, production servers frequently mask their version from external scanners. Here is how you can quickly verify your exact version from your admin dashboard, hosting panel, or command line:
Check PHP Version in WordPress:
- Log in to your WordPress Dashboard as an Administrator.
- In the left sidebar, navigate to Tools → Site Health.
- Click on the Info tab at the top.
- Click to expand the Server accordion section.
- Look for the PHP version row (e.g.
8.3.15or8.2.26).
Check PHP Version in cPanel or Plesk:
- cPanel: Log into cPanel, search for "Select PHP Version" or "MultiPHP Manager" under the Software section. Your domain's active PHP version will be displayed and selectable.
- Plesk: Go to Websites & Domains → find your domain → look for PHP Settings. The active PHP version (e.g., PHP 8.3 FPM) is shown with an option to switch.
Check in Managed Cloud Hosting:
- Cloudways: Select your Server → Settings & Packages → Packages tab. Look for the PHP version.
- Kinsta: In MyKinsta, go to Sites → [Your Site] → Tools → PHP Engine. The active release is displayed.
- WP Engine: In your User Portal, navigate to Sites → [Your Environment]. The PHP version is listed in the environment overview.
Check via SSH / Terminal Command:
Connect to your web server via SSH and execute:
$ php -v
PHP 8.3.36 (cli) (built: Oct 21 2026 09:12:44) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
PHP 8.3.36 (cli) (built: Oct 21 2026 09:12:44) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
Note: The CLI version may sometimes differ from the web server PHP-FPM / Apache module version.
Check with a Safe Temporary PHP Script:
Create a temporary file named version.php in your web root containing:
<?php
header('Content-Type: text/plain');
echo 'Current PHP Version: ' . phpversion();
?>
header('Content-Type: text/plain');
echo 'Current PHP Version: ' . phpversion();
?>
Important: Always delete this file immediately after checking so unauthorized visitors cannot discover your environment details.
Official PHP Release Support Matrix
Source: php.net & endoflife.date
| Branch | Status | Latest Patch Release | End of Life (EOL) Date | Security Recommendation |
|---|---|---|---|---|
| PHP 8.5 | Active Support | PHP 8.5.12 | 2028-11-26 | Fully supported; recommended for new sites |
| PHP 8.4 | Active Support | PHP 8.4.27 | 2027-11-21 | Fully supported; recommended for new sites |
| PHP 8.3 | Security Only | PHP 8.3.36 | 2026-12-31 | Critical security patches only; plan upgrade |
| PHP 8.2 | Security Only | PHP 8.2.35 | 2026-12-08 | Critical security patches only; plan upgrade |
| PHP 8.1 | End of Life (EOL) | PHP 8.1.31 | 2025-11-25 | Upgrade urgently; exposed to CVE exploits |
| PHP 8.0 | End of Life (EOL) | PHP 8.0.30 | 2023-11-26 | Upgrade urgently; exposed to CVE exploits |
| PHP 7.4 | End of Life (EOL) | PHP 7.4.33 | 2022-11-28 | Upgrade urgently; exposed to CVE exploits |
| PHP 7.3 | End of Life (EOL) | PHP 7.3.33 | 2021-12-06 | Upgrade urgently; exposed to CVE exploits |
| PHP 7.2 | End of Life (EOL) | PHP 7.2.34 | 2020-11-30 | Upgrade urgently; exposed to CVE exploits |
| PHP 7.1 | End of Life (EOL) | PHP 7.1.33 | 2019-12-01 | Upgrade urgently; exposed to CVE exploits |
| PHP 7.0 | End of Life (EOL) | PHP 7.0.33 | 2018-12-03 | Upgrade urgently; exposed to CVE exploits |
| PHP 5.6 | End of Life (EOL) | PHP 5.6.40 | 2018-12-31 | Upgrade urgently; exposed to CVE exploits |
Web Server Hardening: How to Hide Your PHP Version
Exposing your PHP version in response headers gives malicious scanners the exact information they need to target known CVE vulnerabilities. Follow these quick steps to mask your PHP version:
1. Turn Off expose_php in php.ini:
; In your php.ini configuration file
expose_php = Off
expose_php = Off
Restart your web server (e.g. systemctl restart php8.3-fpm or systemctl restart apache2) after editing.
2. Hide PHP Headers in Nginx:
# In your nginx.conf server block
fastcgi_hide_header X-Powered-By;
server_tokens off;
fastcgi_hide_header X-Powered-By;
server_tokens off;
3. Minimize Apache Server Banners:
# In your apache2.conf or httpd.conf
ServerTokens Prod
ServerSignature Off
ServerTokens Prod
ServerSignature Off
Frequently Asked Questions
Common questions regarding PHP versions, lifecycle maintenance, and security backports:
How does the PHP Version Checker detect my PHP version?
Our engine sends a non-invasive, passive HTTP request to your website to inspect response headers such as
X-Powered-By, Server banners, X-PHP-Version, and session cookies like PHPSESSID. If the version is disclosed, we match it against the official PHP release matrix.
Why does the report say "Version Masked" for my website?
"Version Masked" means your server is properly configured with
expose_php = Off. It prevents malicious automated bots from fingerprinting your exact PHP version to look for exploit targets. You can still check your version internally via WordPress Site Health or your hosting control panel.
Can an out-of-date version of PHP still have security fixes backported?
Yes. Enterprise Linux distributions (such as Red Hat Enterprise Linux, CloudLinux, AlmaLinux, Ubuntu ESM, and Debian LTS) frequently backport critical security updates into older PHP branches without updating the main version number. If your server is hosted under an enterprise LTS environment, you may already be protected against documented CVEs. However, because external scans only see the reported version string, you should always check directly with your web host to confirm whether enterprise security backports are active on your account.
Which PHP versions are supported in 2026?
As of late 2026, PHP 8.4 and PHP 8.5 receive active bug and security updates. PHP 8.3 and PHP 8.2 are in critical security-only maintenance. All versions of PHP 8.1, 8.0, 7.4, and earlier are officially End-of-Life (EOL) from the PHP Development Team and do not receive official security patches.
What are the risks of running an End-of-Life (EOL) PHP version?
Unsupported PHP versions contain publicly documented Remote Code Execution (RCE) and memory safety vulnerabilities (such as CVE-2026-109618 and CVE-2026-109619). Automated malware bots continuously scan the internet for legacy PHP versions to compromise servers.
How do I upgrade my website to a modern PHP version?
Most web hosting providers (cPanel, Plesk, Cloudways, Kinsta, WP Engine, SiteGround) offer a simple 1-click PHP version switcher in their dashboard. Before switching, ensure your CMS (e.g. WordPress, Drupal) and active plugins are updated to avoid compatibility errors.