Published October 21, 2026Updated October 21, 2026
How to check your PHP version in WordPress or cPanel (PHP2Shell check)
Pixelmosa
Three ways a business owner can check which PHP version a website runs, in WordPress Site Health, in cPanel, or from the site’s public headers, and how to read the number after PHP2Shell.
After the PHP2Shell fixes of October 21, 2026, one number decides whether a PHP website is in the clear: the exact PHP version its server runs. The php.net security advisory lists the fixed releases as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, for the two vulnerabilities CVE-2026-109618 and CVE-2026-109619.
This guide shows three places to find that number without touching your server settings. For the plain-English background, read PHP2Shell: what small businesses should do this week. For the full fixed versions table and a host checklist, see the PHP2Shell exposure check page.
1. In WordPress: Tools, Site Health, Info
WordPress shows the PHP version in its own dashboard. The WordPress page on updating PHP gives the path: from the WordPress Dashboard, select Tools, then Site Health, then the Info tab. Expand the Server section and scroll down to PHP version.
You need an administrator account to see this screen. Write down the full number, for example 8.3.36, not only 8.3. The last part is the one that tells you whether the PHP2Shell fix is in.
2. In cPanel: MultiPHP Manager
Many shared hosts use cPanel. According to cPanel’s documentation, the MultiPHP Manager interface lists your domains with the PHP version each one currently uses. The same page notes that your hosting provider can turn this interface off, and that only the system administrator sets the system PHP version that domains can inherit.
If cPanel only shows a branch such as PHP 8.3, without the final number, that is not enough to confirm the PHP2Shell fix. Ask your host for the exact release.
3. From the outside: the X-Powered-By header
Some servers announce their PHP version to every visitor. The PHP manual explains that the expose_php setting includes the PHP version in an HTTP header, for example X-Powered-By: PHP/8.3.36. You can see response headers in your browser’s developer tools, on the Network tab, by selecting the first request for your page.
Many sites hide this header, which is good practice. If you do not see it, nothing is wrong; it just means the outside view cannot answer the question. That is also the limit of our free check: we only look at what your site publicly shows.
How to read the number for PHP2Shell
Compare what you found with the fixed releases from the PHP advisory:
- PHP 8.5: 8.5.12 or later is fixed
- PHP 8.4: 8.4.27 or later is fixed
- PHP 8.3: 8.3.36 or later is fixed
- PHP 8.2: 8.2.35 or later is fixed
- PHP 8.1, 8.0, 7.4 or older: no official update from the PHP project
If your number is below the fixed release on its branch, ask your host to update and to confirm by email. If you are on PHP 8.1 or older, read PHP 8.1 end of life and PHP2Shell: how to upgrade PHP safely. Some Linux distributions and LTS vendors provide backported fixes, so a host on an older branch may have a fix without a new version number. Only they can confirm that.
The PHP project says updating is the only complete solution. The UK NCSC also encourages organisations to look beyond the main website, to every system running PHP, internet-facing ones first. A forgotten staging copy or an old subdomain counts.
What to send your host
WordPress suggests emailing your hosting company when you need help with PHP, and gives template text on its update page. For PHP2Shell, keep it specific: ask which exact PHP version runs your site, whether it is at or above 8.5.12, 8.4.27, 8.3.36 or 8.2.35, whether PHP was restarted after the update, and whether any other copy of the site runs PHP. The full six-question list is on the PHP2Shell exposure check page, ready to copy.
If you would rather have a second pair of eyes, request a free PHP2Shell exposure check. We note what your website publicly reports, with no login, no scanning for weaknesses and no exploit testing, and we email you within 24 hours.
Sources
Questions small business owners ask
How do I check my PHP version in WordPress?
In the WordPress Dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version line shows the version your site runs. You need an administrator account.
How do I check the PHP version in cPanel?
Open MultiPHP Manager. It lists your domains with the PHP version each one uses. If it shows only a branch like 8.3, ask your host for the full release number.
Which PHP version number means PHP2Shell is fixed?
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release on the same branch. PHP 8.1 and older get no official update from the PHP project.
My site does not show its PHP version publicly. Is that a problem?
No. Hiding the version is good practice. It only means the answer has to come from your WordPress dashboard, your hosting panel or your host.