How to check if your website uses PHP

1. Run a quick check

Enter your website's address in our free checker. It looks at what your website shows publicly, such as headers, cookies and the software's fingerprints, and tells you whether it found PHP and how sure it is. It takes a few seconds and stores nothing.

A check can't see everything: some websites hide what they run on. If it says “No signs”, that isn't proof your website is safe, so use one of the other ways below to confirm.

2. Know which software your website uses

If you know how your website was built, you usually know the answer:

• Runs on PHP: WordPress, WooCommerce, Joomla, Drupal, Magento / Adobe Commerce, PrestaShop, TYPO3, Shopware, OpenCart, Craft CMS, Kirby, Moodle, MediaWiki, Nextcloud, and most other website software you install on your own hosting.
• Doesn't use PHP for your site: Shopify, Wix, Squarespace, Webflow, Framer. These hosted site builders run the servers for you.
• Usually no PHP: websites built with tools like Next.js, Gatsby, Hugo or Astro, hosted on platforms like Vercel, Netlify or GitHub Pages.

Not sure what your website was built with? The name often appears at the bottom of the admin area you log in to, or in the invoice from whoever built it.

3. Look in your website's admin area

Most PHP software shows its PHP version somewhere in the admin area. In WordPress, for example, go to Tools → Site Health → Info → Server. If you find a PHP version there, your website uses PHP. Each platform page linked above says where to look for that software.

4. Check your hosting control panel

Log in to your hosting account and look for a PHP setting. In cPanel it's usually called MultiPHP Manager or Select PHP Version, in Plesk PHP Settings, and in DirectAdmin Select PHP version. If your website's hosting package has a PHP version set, your website very likely runs on PHP, and this is also where it can be updated.

5. Ask your host or developer

This is the surest way. A short email is enough: “Does our website, or anything else you run for us, use PHP? If so, is it updated to a version that fixes the October 2026 security issue?” Our checker gives you a longer, ready-to-send message.

For developers

• Response headers: X-Powered-By: PHP/8.x (often hidden), or a PHPSESSID cookie.
• Addresses ending in .php, or a working /index.php.
• On the server: php -v on the command line, or the PHP version shown by the hosting panel. If you use a phpinfo() page to check, remove it afterwards.

It uses PHP. Now what?

Get PHP updated to a fixed version. Our explainer covers which versions are fixed and what to do if you can't update right away.