What PHP version is my website running?
You need the number to know whether PHP2Shell applies to you. Here are four ways to get it, from ten seconds to certain.
Four ways, easiest first: run our free checker (reads what your server announces); in WordPress, open Tools → Site Health → Info → Server; look in your hosting control panel (cPanel's MultiPHP Manager, or your host's PHP setting); or ask your host, which is the only method that also catches a backported fix.
1. The checker (ten seconds)
Type your address into remidiy.com/php-vulnerability-checker. About one site in thirteen announces its PHP version in a response header, and for those you get the exact number. Most sites hide it (a sensible default), and the checker then tells you it runs PHP and to ask your host.
2. WordPress Site Health (one minute)
Log in to the WordPress dashboard, go to Tools → Site Health, open the Info tab and expand Server. “PHP version” is there with the full patch number, which is exactly what you need to compare against 8.2.35, 8.3.36, 8.4.27, 8.5.12. Site Health also warns on its Status tab when PHP is out of date.
3. Your hosting control panel (two minutes)
Every host shows the PHP version somewhere you can change it: cPanel's MultiPHP Manager, GoDaddy's site settings, SiteGround's Site Tools → Devs → PHP Manager, Hostinger's Advanced → PHP Configuration, WP Engine's and Kinsta's site environment pages. Note that these often show the branch (“8.3”) rather than the patch (“8.3.36”).
4. Ask your host (the certain answer)
A support ticket with one question: “Which exact PHP version is my site on, and does it include the PHP2Shell fix (CVE-2026-109618 and CVE-2026-109619)?” This is the only method that also catches a backported fix, where the host patched PHP without changing the version number. If they say yes in writing, that beats what any checker reports.
Once you know
Compare against the table on the PHP2Shell page. Below the fixed release in your branch: update. On 8.1 or older: move to 8.2 or newer. On a fixed release: you're done.
Sources
- WordPress.org: the Site Health screen
- PHP manual: phpinfo() and phpversion()
- PHP: supported versions and end-of-life dates
Common questions
What is the quickest way to find my website's PHP version?
Run the PHP vulnerability checker: if your server reports its version, you'll see it in seconds. If it's hidden, look in your hosting control panel or WordPress Site Health, or ask your host.
Is it safe to leave a phpinfo() page on my site?
No. A phpinfo() page shows your full server configuration to anyone. Use it briefly to read the version, then delete the file.
Why is my PHP version hidden?
Many hosts set expose_php = Off so the server doesn't advertise its version, which is a sensible setting. How to hide your server and PHP version explains it.
Part of PHP2Shell: is your website affected, and what to do. Not sure which setup you have? Run the free PHP check and the result tells you.