Your website’s PHP version is a number like 8.1.29 or 8.3.36. It appears nowhere on the site itself, yet it decides whether your site still gets security fixes. Since the PHP flaws of 21 October, plenty of owners are asking about it for the first time. Here are five ways to find it, from the easiest to the most technical, and then what to do with the answer.

Why the number matters

PHP is the programming language that WordPress, Joomla, Drupal and most other website systems run on. Each version gets bug fixes for a couple of years, then security fixes only, then nothing at all. A site on a version without security fixes is like a shop whose broken window nobody will replace.

Version Security fixes until
PHP 8.5 31 December 2029
PHP 8.4 31 December 2028
PHP 8.3 31 December 2027
PHP 8.2 31 December 2026
PHP 8.1 none since 31 December 2025
PHP 8.0, 7.x none for years

What that means in practice: for the flaws of 21 October 2026 there were updates for 8.2 to 8.5. For 8.1 and older the PHP project released none. If your site was on one of those, you were relying on your host’s goodwill.

Way 1: in WordPress, no technical knowledge needed

  1. Log in to your WordPress admin (your-website.co.uk/wp-admin).
  2. In the menu on the left: Tools → Site Health.
  3. Choose the Info tab at the top.
  4. Open the Server section. It shows “PHP version”, for example 8.1.29.

WordPress sometimes tells you without being asked: the dashboard shows “PHP update required” when your version is out of date. Take it seriously.

Way 2: in Joomla, Drupal and the rest

  • Joomla: in the administrator, System → System Information. The PHP version is on the first tab.
  • Drupal: Reports → Status report. PHP is in the list of system values.
  • TYPO3: Admin Tools → Environment, the “Environment overview” card (under System in TYPO3 14).
  • Anything else: nearly every system shows the version in the system information of its admin area.

Way 3: in your host’s control panel

This is where you can not only see the version but change it. Every host names its menus a little differently:

  • IONOS: log in, open Hosting (choose the right contract if you have several), then Manage on the PHP tile. A table lists every domain with its version. On Managed WordPress and MyWebsite, IONOS sets the version itself.
  • SiteGround: Site Tools → Devs → PHP Manager.
  • 123 Reg and GoDaddy share one control panel: open your hosting, then Settings → Server, and Manage next to “PHP version”.
  • Krystal and other hosts with cPanel: Software → Select PHP Version, or MultiPHP Manager, which sets the version per domain. Krystal’s managed WordPress (Onyx) shows it on the site’s Edit Site tab.
  • Hostinger: Websites → Dashboard next to your site, then PHP Configuration.
  • Bluehost: Websites → Manage Site → Advanced, the “PHP Version” tile.
  • Plesk, which some hosts use: Websites & Domains → PHP Settings.
  • Managed WordPress hosting (Kinsta, WP Engine, 20i and others) sets the version for you and shows it in the site’s overview.

Can’t find the menu? Your host’s support can answer “Which PHP version is my domain on?” in a minute. Ask in writing, so you have the answer to hand later.

Way 4: without logging in, from the outside

No login, because the agency has it, or your nephew, or nobody any more? Then look from the outside. Johnny’s free report looks at your website the way a visitor or an attacker does, and shows the PHP version if your server sends it along. Most do. It also tells you whether that version still gets security fixes, which plugins can be seen from outside and whether your admin login is open to anyone.

Check your website at the end of this page: about a minute, no sign-up, and nothing changes on your site.

If your server doesn’t send the version, that’s not a fault but caution. Then ways 1 to 3 remain.

Way 5: with a file, for the brave

If you can reach your web space by FTP, create a file called info.php there containing just this one line: <?php phpinfo();. Open your-website.co.uk/info.php and it shows the version and every setting of the server. Which is exactly why you should delete the file straight away. It tells attackers more than you’d like.

The number alone isn’t enough

One warning that has mattered since 21 October. Many hosts and Linux distributions build a security fix into the version you already have, without raising the number. A site can then show “8.3.35” and still have the fix from 8.3.36. The other way round, a self-built installation can report “8.3.36” because someone only changed the label.

So the version number tells you whether your version is still looked after in principle. Whether a particular fix is in, only your host can tell you. Ask them, in writing.

What to do with the answer

PHP 8.3 or newer: good. Let your host install the minor updates automatically (nearly all do), and check the version once a year.

PHP 8.2: still supported, but only until 31 December 2026. Plan the move to 8.3 or 8.4 for the next few weeks, not for 30 December.

PHP 8.1 or older: act now. Either your host has patched the old version themselves (ask), or you switch. Switching is one setting in your control panel, but it can break your site if an old theme or plugin doesn’t work with the new version. So:

  1. Take a backup first, in the control panel or with a backup plugin.
  2. Update every plugin and your theme while the old version is still running. Outdated plugins are the most common reason a switch goes wrong.
  3. Switch, ideally in the evening or at the weekend.
  4. Open every important page, send the contact form, look at it on your phone.
  5. A white page or an error message? Switch back to the old version (the same setting) and get help. But don’t leave the site on 8.1 for good. An error after an update is annoying; an open hole costs more.

And on Johnny?

On Johnny there’s no PHP version for you to check. Your site is delivered as finished pages: no PHP runs on your domain, and there are no plugins and no admin login. What runs on our side, the contact form and Johnny itself, we keep up to date. That’s included in the monthly fee. How the move works: How it works.

Sources