Does my website
use PHP?
A critical security issue in PHP lets attackers take over web servers. Check your website in seconds and find out what to do.
Questions & answers
How can I tell if my website uses PHP?
Enter your website's address above: we look for signs of PHP in what your website shows publicly. Most website software you install yourself, such as WordPress, Joomla, Drupal, Magento and PrestaShop, runs on PHP. Hosted site builders like Shopify, Wix and Squarespace don't use PHP for your site. The surest answer comes from your host or developer.
Is my WordPress site affected?
Yes, if you run WordPress on your own hosting: WordPress runs on PHP, so the PHP version on your server needs to be updated. On WordPress.com, Automattic maintains the servers and PHP for you.
What should I do if my website uses PHP?
Ask your host or developer to update PHP to a fixed version today. If that isn't possible right away, have the PHP project's temporary protections applied, or consider taking the site offline until it's fixed, as the NCSC advises. Then have the server checked for signs of a break-in.
Why does the check say “No signs”?
We can only see what your website shows publicly, and many websites hide what they run on. “No signs” means we found nothing that points to PHP, not that your website is safe. Ask your host or developer to confirm.
Which PHP versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and newer releases. PHP 8.1 and older no longer receive security fixes, so websites on those versions need to move to a supported, fixed version.
Do you store the website I check?
No. The address is used to run the check and then discarded, and the result isn't stored either. To prevent abuse we only keep short-lived, scrambled counters that can't be turned back into an address.