How to Check Your PHP Version

Why the exact version matters

Most security decisions about PHP start with one number. Whether a vulnerability affects you, whether your branch still receives fixes, and whether a plugin or framework will run all depend on the full version string, for example 8.3.36, not just “PHP 8”.

A PHP version has three parts:

Part	Example	Meaning
Major	8	Large language changes, may break code
Minor (branch)	8.3	A release line with its own support lifecycle
Patch (release)	8.3.36	Bug and security fixes within the branch

The minor version tells you which branch you are on and how long it is supported. The patch number tells you which fixes are included upstream. You need both.

Method 1: The command line

If you have SSH access, this is the fastest and most precise method.

php -v

Typical output:

PHP 8.3.36 (cli) (built: Oct 21 2026 10:12:44) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies

The first line gives the version and the SAPI, here cli. To print only the version number, which is useful in scripts:

php -r 'echo PHP_VERSION, PHP_EOL;'

To see full configuration details, including the loaded php.ini and compiled extensions:

php -i | head -n 20
php --ini

To inspect a single extension and its version, use --ri:

php --ri openssl
php --ri curl

The CLI may not be what your website uses

This is the most common mistake. The php binary on your PATH is the command-line interpreter. Your website may be served by a different binary entirely: PHP-FPM, an Apache module, or a per-site version selected in a hosting panel. Servers often have several PHP versions installed side by side.

Check which versions exist:

ls /usr/bin/php* /usr/sbin/php-fpm* 2>/dev/null
systemctl list-units --type=service | grep -i fpm

Then check the FPM binary directly, for example:

php-fpm8.3 -v

To find which FPM pool your web server talks to, look at the fastcgi_pass (nginx) or SetHandler/ProxyPassMatch (Apache) directive in your site configuration.

location ~ \.php$ {
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}

Method 2: A temporary phpinfo() page

When you cannot run commands, or you want to confirm the version the web server really uses, a phpinfo() page shows it directly.

1. Create a file with a random, hard-to-guess name, for example info-7f3k2q.php, in your web root.

2. Add this single line:

   <?php phpinfo();

3. Open it in your browser. The version appears at the top of the page, and the “Server API” row shows whether it runs as FPM/FastCGI or an Apache module.

4. Delete the file immediately after reading it.

Do not leave a phpinfo() file on a live server. It discloses your PHP version, file paths, loaded extensions, environment variables and sometimes credentials passed through the environment. Attackers routinely scan for common names such as info.php and phpinfo.php.

If you only need the number, a smaller script leaks far less:

<?php echo PHP_VERSION;

Delete this one as well when you are done.

Method 3: WordPress Site Health

WordPress 5.2 and later includes a Site Health screen that reports the PHP version actually used by WordPress.

1. Log in as an administrator.
2. Go to Tools → Site Health.
3. Open the Info tab.
4. Expand the Server section.

You will see the PHP version, the SAPI, memory limit and other server details. The Status tab may also warn you if the version is outdated. For a broader look at WordPress hardening, see the WordPress security overview.

Method 4: Hosting control panels

cPanel

Depending on your host, cPanel offers one or both of these tools:

• MultiPHP Manager: lists each domain with its assigned PHP version.
• Select PHP Version (CloudLinux): shows the current version and lets you change it and toggle extensions.

The cPanel home screen sidebar may also display a PHP version, but that can be the server default rather than your domain’s setting. Check the per-domain view.

Plesk

In Plesk, go to Websites & Domains, select the domain, and open PHP (sometimes labelled PHP Settings). The page shows the PHP version and handler, for example “FPM application served by nginx”.

Method 5: From outside, via HTTP headers

Some servers announce the PHP version in a response header:

curl -sI https://example.com | grep -i x-powered-by

X-Powered-By: PHP/8.2.20

This is useful for auditing sites you manage, but it is also a problem: it tells every visitor, including automated scanners, exactly which version to target. Disable it in php.ini:

expose_php = Off

Restart PHP-FPM or your web server afterwards. The website security checker reports whether your site exposes this header along with other common configuration issues.

Absence of the header proves nothing about the version in use. Many hosts strip it, and some proxies add their own.

Reading the result

Once you have a version string, ask three questions.

1. Is the branch supported? Compare the minor version with the official list. As of October 2026, PHP 8.2 through 8.5 receive at least security fixes; 8.1, 8.0 and all 7.x branches are end of life. The PHP security support lifecycle guide explains the schedule.
2. Is it the latest release in that branch? If a newer patch release exists, you are missing fixes. For example, on 2026-10-21 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix critical vulnerabilities.
3. Do known CVEs affect this version? Enter the version into the PHP version checker to see published vulnerabilities whose affected ranges include it.

A caveat about distribution packages

If PHP came from your Linux distribution’s repositories (Debian, Ubuntu, RHEL and derivatives), the version string may look old even though security fixes have been applied. Distributions often backport patches without changing the upstream version number. A string such as 8.1.2-1ubuntu2.x can carry fixes released long after upstream 8.1.2.

PatchScope’s checker evaluates upstream version numbers, so for distribution packages its result is a starting point, not a verdict. To confirm patch status on a packaged install, follow how to check whether a PHP security patch is installed.

Quick reference

Situation	Command or location
SSH access	php -v, php-fpm8.x -v
Only the number	php -r 'echo PHP_VERSION;'
Extension details	php --ri <extension>
No shell	Temporary phpinfo() file, deleted after use
WordPress 5.2+	Tools → Site Health → Info → Server
cPanel	MultiPHP Manager or Select PHP Version
Plesk	Websites & Domains → PHP
External check	curl -sI and look for X-Powered-By