PHP maintenance and security
How to Check Your PHP Version
Check your PHP version using php -v, WordPress Site Health, cPanel, Plesk or Docker, then confirm the web runtime and vendor security package build.
Last updated: · Sources reviewed: 2026-10-23
What is the current PHP version?
Data from endoflife.date, fetched . Status computed on 2026-10-23.
| Branch | Latest in snapshot | Status |
|---|---|---|
| 8.5 | 8.5.12 | Active |
| 8.4 | 8.4.27 | Active |
| 8.3 | 8.3.36 | Security only |
| 8.2 | 8.2.35 | EOL in 69 days |
| 8.1 | 8.1.34 | End of life |
Command line: version and configuration
php -v
php --ini
php -m
# Debian / Ubuntu: list installed branch directories
ls /etc/php/
# On systemd servers: inspect PHP services
systemctl list-units 'php*'The first command prints a PHP version and SAPI such as CLI. --ini reports the configuration files; -m lists modules. These PHP CLI options describe the shell installation, which may differ from FPM.
WordPress: Site Health
Sign in as an administrator, then open Tools → Site Health → Info → Server. Read the PHP version field. This checks the runtime serving WordPress. Follow the official Site Health documentation; a WP-CLI result still describes a CLI process.
cPanel: check each domain
Open Software → MultiPHP Manager and read the PHP version beside the domain. Inspect subdomains too. A system default is not necessarily applied to every site. cPanel documents the per-domain version selector.
Plesk: check the domain handler
Open Websites & Domains, find the domain and click PHP. Read the selected version and handler. The available choices depend on permissions and installed components; ask the administrator if the selector is absent. See Plesk's PHP settings instructions.
Docker: inspect the running container
docker ps --format '{{.Names}} {{.Image}}'
docker exec <container> php -v
# For a Compose service named wordpress:
docker compose exec wordpress php -vReplace the placeholder with your own container name. Check each web and background service. The downloaded image tag does not prove a running container was recreated.
Last resort: a temporary diagnostic endpoint
Prefer the authenticated panel or Site Health. If you administer the server and need a web check, restrict access to an authenticated administrator and return only PHP_VERSION. Remove the endpoint immediately. Avoid publishing a full phpinfo() page: it exposes configuration, paths and potentially environment values.
Why response headers are not proof
An X-Powered-By header may be disabled, altered or stale. It cannot establish the patch status of distribution backports. Use the actual runtime and package advisory.
I found my version — now what?
- Below a fixed release? Follow the environment-specific PHP2Shell patch guide.
- Patched? Plan the next branch change with PHP support and EOL dates.
- On an unsupported branch? Use the WordPress upgrade and rollback checklist.
FAQ
How do I check my PHP version?+-
Run php -v on the server, or open WordPress Tools → Site Health → Info → Server. In cPanel, inspect the domain in MultiPHP Manager. Check the web runtime separately from CLI, because multiple PHP installations can coexist.
What is the current PHP version?+-
This reviewed snapshot lists 8.5.12 as the latest stable PHP release. Other supported branches have separate latest versions. See the table and fetched date; consult php.net before treating a cached snapshot as current.
Why does php -v differ from my website?+-
The shell resolves a command-line PHP executable, while the web server can route the domain to another FPM pool or panel-selected handler. A container may have another installation. Check the PHP version used by the actual domain and every background worker.
Related PHP guides
- PHP2Shell affected versions and patch steps
- PHP support deadlines and upgrade planning
- Upgrade WordPress PHP with staging and rollback
Sources
- PHP command-line options
- WordPress Site Health
- cPanel MultiPHP Manager
- Plesk PHP settings
- PHP security advisory and releases
- endoflife.date PHP data
- Docker Compose pull
This page is general guidance, not a security audit. Version numbers and vendor package names change; confirm against your vendor's advisory before you rely on them. “Not found” or “patched” here does not mean your site is safe. We do not publish exploit code or lists of affected websites.