Check PHP version: find the PHP your website really runs

How do I check the PHP version in WordPress?

WordPress shows the PHP version in Site Health; you need an administrator account.

1. Open Tools → Site Health in the WordPress dashboard.
2. Switch to the Info tab and expand Server.
3. Note PHP version and PHP SAPI, then enter both in the PHP version checker.

The WordPress PHP version guide explains what to do if the version is too old.

How do I check the PHP version in cPanel?

cPanel shows and changes PHP per domain in MultiPHP Manager, usually under Software. Find your domain in the list and note its PHP version. If you can’t see MultiPHP Manager, your host controls PHP for you; see change PHP version in cPanel and ask support.

How do I check the PHP version in Plesk?

In Plesk, go to Websites & Domains, pick the domain and open its PHP settings. The selected PHP version and handler are shown there. A selector shows which versions are available; it doesn’t prove that the installed build contains the PHP2Shell fix.

How do I check the PHP version over SSH?

php -v prints the version of the command-line PHP on that host. Your website may use a different PHP through PHP-FPM or Apache, especially on servers with several PHP versions installed side by side. To see what the website really runs, check WordPress Site Health or your control panel, or ask whoever manages the server which PHP-FPM pool or Apache module serves the site. Then enter the version and how PHP runs in the PHP version checker.

If PHP came from your Linux distribution, also note the package version (for example from your package manager). Distributions often backport security fixes without changing PHP’s own version number; see update PHP on Ubuntu.

How do I check the PHP version in Docker?

Look at the image your container is built from, in the FROM line of your Dockerfile or the image: line of your compose file. The image tag usually names the PHP version. Containers keep the PHP they were built with until you rebuild and redeploy them, so also confirm the running container, not only the file. See Docker PHP image.

Why does the command line show a different PHP version than my website?

Servers often have several PHP versions installed, and the command line, PHP-FPM and Apache can each use a different one. Workers that haven’t restarted since an update also keep running the old PHP. Only the PHP that serves your website decides whether the site is affected by PHP2Shell, which is why the checker asks how PHP runs.

Is it safe to publish a phpinfo page to check?

Don’t publish a phpinfo() page: it exposes paths, modules and settings that help attackers, and it’s easy to forget online. WordPress Site Health or your control panel shows the PHP version without exposing anything publicly.

Is the PHP version number enough to know I’m patched?

Not always. A version at or above 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (for its branch) contains the upstream fix. A lower number from a Linux distribution may still be patched by a backport, and a custom build needs its own evidence. A fixed version also says nothing about whether the site was attacked before you updated. Go back to the PHP2Shell checker to interpret your result.

Which sources support this page?

• WordPress.org: Site Health screen
• cPanel: MultiPHP Manager
• Plesk: PHP settings
• PHP manual: phpversion
• PHP manual: php_sapi_name
• Docker: docker compose up