Paste your website URL
Enter a public HTTP or HTTPS address. Already know your PHP version? Use the manual version tab.
01 / THE PHP FIELD TOOL
PHP version.
Checked.
A little clarity for your server.
Find your PHP version and its PHP2Shell patch status from public response headers.
Free to use. Open source.
No account. No installation.
No account. No installation.
PHP VERSION CHECKERINPUT / 01
Read-only check
Ready when you are.
Run a check to see the reported version, patch warning, and response headers.
PHP version
PHP2Shell patch status
Check method
View response headers
100% free to useOpen-source checkerNo exploit probes
REFERENCE / OCT 21, 2026
PHP2Shell: the fixed release thresholds
From the PHP security advisory ↗. Newer patches in these branches also qualify.
These are patch thresholds, not a live list of the latest PHP releases.
PHP 8.28.2.35+
PHP 8.38.3.36+
PHP 8.48.4.27+
PHP 8.58.5.12+
02 / THE PROCESS
Less guesswork. More context.
Read the public headers
We send HEAD, with GET only for a 405 or 501 response. No redirects, page-body inspection, or exploit probes.
Get your version & next step
See the advertised PHP version and a version-based patch warning. Copy or download the report as JSON.
03 / READING THE SIGNAL
A useful signal.
A clear set of limits.
This PHP version checker identifies the version a website advertises in its Server or X-Powered-By headers. It then applies the PHP2Shell version rules from OpenAI’s open-source checker.
Hidden headers return Unknown. A vendor may backport fixes without changing the advertised version. Always confirm the installed package with your host.
Public headers vs. your installed PHP versionCLI / ANOTHER WAY TO CHECK
# Have terminal access? Run:
$
php -v# This checks your CLI PHP version.
# Your website may use a different runtime.
04 / FIELD NOTES
A few useful things to know.
3 practical methods
How to check your PHP version
Check a website, use your hosting panel, or run one terminal command.
Read the guide WordPress guideHow to check PHP in WordPress
Find your server’s PHP version in WordPress Site Health, step by step.
Read the guide Choose your methodPHP Checker vs. phpinfo() vs. php -v
Compare public headers, web runtime details, and your command-line version.
Read the guide05 / QUESTIONS & ANSWERS
Before you check.
What this free tool can tell you, what it can’t, and where to look next.
Explore the original checker ↗Is this PHP version checker free?
Yes. Website checks and manual version checks are free, with no account or payment required. URL checks have a fair-use limit of approximately 20 requests per minute per IP address at each Cloudflare location.
How do I check the PHP version of a website?
Paste the website’s public URL and select Check PHP version. The tool reads Server and X-Powered-By response headers. If the server hides its PHP version, use your hosting panel, WordPress Site Health, or php -v instead.
Why does my result say Unknown?
Unknown means the checker cannot confirm a supported stable PHP version. Common reasons include hidden headers, a redirect, a blocked request, an unreachable website, a prerelease version, or a branch outside the current rules. It does not mean the site is secure or does not use PHP.
Does a green result mean my website is secure?
No. A green result only means the reported version meets the PHP2Shell patch threshold for its branch. Headers can be changed or hidden, and vendor packages may include backported fixes. Confirm the installed build and patch status with your hosting provider.
Does the checker follow redirects or scan my website?
No. It checks the URL you enter without following redirects. It sends one HEAD request and uses GET only if HEAD returns HTTP 405 or 501. It does not inspect response bodies, execute PHP, or send exploit probes.
Can I check localhost or a private server?
No. Website checks accept public domain names on standard HTTP or HTTPS ports. IP addresses and private networks are blocked. For a local installation, run php -v and paste the full version into the Enter a version tab.
Do you save the URLs I check?
The application does not save submitted URLs or reports in a database. Manual version checks run in your browser. URL checks are processed through Cloudflare; infrastructure providers may process request metadata under their own privacy policies.