Free tool · no signup

PHP version checker: is your PHP still safe?

Check a website address, or type the PHP version you run. You see whether that version is supported, when support ends and which security fixes later releases have added.

By the Bug Circuit security team · Last updated October 24, 2026

What PHP version is a site running, and is it safe? Enter the address or the version. The tool reads the version a server announces, compares it with php.net, and lists the security fixes released since.

How it works

How the check works

In address mode the tool loads your page once, like a browser, and reads the response headers. A server that sends X-Powered-By: PHP/8.2.30, or a Server header that includes the PHP version, gives the version away. Many well-run servers hide it, and then the tool says it cannot see the version and tells you how to find it on the server. It also notes the platform it recognises, such as WordPress, Drupal or Laravel, from the page itself.

The version is then compared with php.net. The supported versions page gives the dates each branch stops getting bug fixes and stops getting security fixes. A branch is Actively supported, Security fixes only, or End of life. The official changelog lists every release with the security advisories it fixed, shown with their GHSA and CVE identifiers. The tool lists the fixes released after your version in the same branch, newest first, so you can see what an update would close.

Reading the result

End of life matters most. When a branch reaches the end of security support, new flaws are never fixed there, and each one stays open for good. Security fixes only means the branch still gets patches but not bug fixes, so update on the regular schedule. A site can be on a supported branch and still be several patch releases behind, which is where most real exposure is.

One caution applies to servers that install PHP from Ubuntu, Debian or Red Hat. Those distributions often copy a security fix into their older package without changing the version number. A site on PHP 8.1.2 from Ubuntu 22.04 may be patched even though the number looks old. The tool names the distribution when the server header gives it away, and the way to be sure is the package changelog.

The tool does not test for any flaw. A missing fix is a reason to update, not proof that the site can be broken into. Only check sites you own or manage.

Worked examples

A supported branch that is behind

Type 8.2.30

PHP 8.2 gets security fixes only, until 31 Dec 2026.
5 releases behind. The latest is 8.2.35.
25 fix entries with security identifiers released since.

Result on 24 Oct 2026. Updating inside the branch is the quick win, and the branch itself ends in a few months.

An end-of-life branch

Type 8.1.2

PHP 8.1 reached end of life on 31 Dec 2025.
16 later releases carry 43 fix entries with security identifiers.

Move to a supported branch such as 8.4 or 8.5. If the PHP comes from a Linux distribution, check whether the distribution still patches it.

A site that hides its version

Enter an address whose server sends no PHP version

PHP is in use, but its version is not visible.
Run php -v on the server, then use the version box.

Hiding the version is good practice, so this is the normal result for a careful host.

Frequently asked questions

How do I find out what PHP version my website uses?

Enter the address above. If the server announces its version, you get it at once. Otherwise run php -v on the server, open Site Health in WordPress, or look under PHP settings in your hosting panel.

Which PHP versions are still supported?

The tool shows the live table from php.net. As of 24 Oct 2026 PHP 8.2, 8.3, 8.4 and 8.5 receive security fixes. PHP 8.1 and older are end of life.

What does end of life mean for PHP?

The PHP team no longer releases fixes for that branch, including security fixes. New flaws found in it stay open, and attackers can use them against sites that still run it.

Why does the tool say the version is hidden?

Servers can leave the version out of the headers (expose_php = Off and ServerTokens Prod). That is good practice, and it means an outside tool cannot read the version. Find it on the server and use the version box.

My host says PHP 8.1 is fine. Is it?

Possibly. Some hosts and Linux distributions backport security fixes to older versions. Ask them in writing which security fixes they apply and for how long. If they do not, upgrade.

Does updating PHP break my site?

A patch release inside a branch, such as 8.2.30 to 8.2.35, rarely does. A move to a new branch can, because old features are removed. Test on a staging copy and check your plugins and themes first.

Is it safe to run this on my site?

Yes. In address mode it makes one ordinary page request and reads the headers. In version mode no site is contacted at all.

Keep reading

Composer Audit OnlineCheck the packages your PHP app depends on.Laravel and PHP Security Checklist31 scored checks with reasons.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing