devsecurity
Sign in

How to check a website's PHP version (and why it is often hidden)

Updated

Knowing the PHP version matters because runtime flaws, such as the PHP2Shell vulnerabilities, are fixed only by upgrading PHP itself. Updating your site's own dependencies does not help. Here is how to find the version from the outside and from the inside.

Check from the outside: response headers

Many PHP servers announce their version in the X-Powered-By header. Ask for the headers of any page you are authorized to test:

curl -sI https://example.com | grep -iE "x-powered-by|^server"

A result such as X-Powered-By: PHP/8.2.12 is direct evidence of the version the server reports. A Server header like Apache/2.4.57 (Debian) PHP/8.1.27 works the same way.

Many hosts hide this on purpose (expose_php = Off), and CDNs or reverse proxies often strip it. No header does not mean no PHP, and it does not mean a safe version. It means the version cannot be read remotely.

Check from the inside: on the server you control

On the server, ask PHP directly. Run the command as the same user and PATH your web server uses, because servers often have more than one PHP installed:

php -v
php-fpm8.2 -v   # or php-fpm -v, depending on your distribution
php -i | grep -E '^PHP Version'

Never leave a public phpinfo() page online to find the version. It exposes configuration to everyone.

Check inside a container

A website address cannot show what is inside a container image. Run PHP in the image, or scan the image itself:

docker run --rm your-registry/your-app:1.4.2 php -v

Why the version number can mislead

Linux distributions often backport security fixes without changing the upstream version number, so a server can report PHP 8.2.12 and still be patched. Check the package changelog:

apt changelog php8.2-cli | head -n 40      # Debian / Ubuntu
rpm -q --changelog php-cli | head -n 40    # RHEL family

This is why devsecurity labels a PHP result as confirmed, likely or unknown, and why version-based findings carry a note about backports.

Hiding the version is not patching

Setting expose_php = Off in php.ini and removing X-Powered-By stops casual fingerprinting, and we recommend it as hardening. It does not remove any vulnerability. Upgrade PHP to a fixed release.

Frequently asked questions

Can I tell the PHP version of any website?

Only when the server reveals it, usually in the X-Powered-By or Server header. Many sites hide it, so a remote tool should say “could not be confirmed” instead of guessing.

Does a hidden PHP version mean the site is safe?

No. It only means the version cannot be read from outside. Check on the server with php -v or scan the container image.

Related guides