Is our website on a supported PHP?
Type the address. We open the page once and tell you what it shows (an estimate).
This tool has one job: feel the current PHP problem in 10 seconds, and know the one thing to ask your web developer.
- Our server opens that page once, just like visiting it in a browser.
- No admin-page hunting, no other paths, no attack requests.
- The address is never stored.
How it works (passive, one look)
One request · headers and the first page's HTML only
Our server opens the page once, like a browser visit. It never looks for admin pages, never requests other paths and never sends attack requests. Please only check sites you run or may check.
- One GET. Up to 3 redirects are followed, and every new address is re-checked.
- 5 seconds in total; at most 1 MB of the page’s HTML is read. http/https on ports 80/443 only.
- No cookies, no login, never a second request to confirm.
- We identify as
User-Agent: plusbeauxjours-php-check/1.0 (+https://plusbeauxjours.com/php-check/)
Check it in your own browser
- Open the site in Chrome or Edge and press F12 (⌥⌘I on a Mac).
- Open the Network tab and reload.
- Click the first document row and look for X-Powered-By and Server under Response Headers.
- Something like PHP/7.4.33 is the visible version. Nothing there means it is hidden.
What counts as evidence
certain · high · medium
| What we see | Confidence | Means |
|---|---|---|
| PHP/x.y.z in the X-Powered-By header | certain | PHP and its version (php.net default expose_php = 1) |
| PHP/x.y.z in the Server header | certain | PHP and its version |
| PHPSESSID cookie name | high | PHP (default session name) |
| ci_session · laravel_session cookie names | high | CodeIgniter · Laravel |
| wordpress_ · wp-settings- cookie names | high | WordPress |
| generator meta tag · X-Generator header | high | WordPress · Rhymix · XE · Joomla · Drupal |
| same-site /wp-content/ · /wp-includes/ paths | high | WordPress |
| var g5_shop_url · var g5_url | high | Youngcart5 · Gnuboard5 |
| same-site .php links | medium | PHP |
The PHP version comes only from X-Powered-By, then the Server header, never from the CMS. PHP in a header = certain; other marks only = likely; nothing = no trace (estimate). HTML comments, cross-site .php links and Express/ASP.NET headers don't count.
Support status is computed from php.net's table and today's date in Korea. Patch numbers are only compared with the 10/21 fixed versions; distribution builds (8.1.2-1ubuntu…) can't be judged by number.
PHP support dates
php.net · checked 2026-10-23
| Branch | Active support until | Security support until |
|---|---|---|
| PHP 8.2 | 2024-12-31 | 2026-12-31 |
| PHP 8.3 | 2025-12-31 | 2027-12-31 |
| PHP 8.4 | 2026-12-31 | 2028-12-31 |
| PHP 8.5 | 2027-12-31 | 2029-12-31 |
| PHP 8.1 | End of life 2025-12-31 | |
| PHP 8.0 | End of life 2023-11-26 | |
| PHP 7.4 | End of life 2022-11-28 | |
| PHP 7.3 | End of life 2021-12-06 | |
| PHP 7.2 | End of life 2020-11-30 | |
| PHP 7.1 | End of life 2019-12-01 | |
| PHP 7.0 | End of life 2019-01-10 | |
| PHP 5.6 | End of life 2018-12-31 | |
Source: php.net supported versions · php.net EOL · checked . Each date is the last supported day. 8.6 is not in php.net's table yet, so it shows as “not in php.net table”.
The October 2026 advisory
CVE-2026-109618 · CVE-2026-109619
- On 2026-10-21 the PHP team released 8.2.35, 8.3.36, 8.4.27, 8.5.12, fixing CVE-2026-109618 and CVE-2026-109619 (CVSS v4 9.2, Critical, per php.net and GHSA).
- 8.1 and older get no official update; minimal source patches for 7.4, 8.0 and 8.1 are not supported releases.
- A server not restarted after updating keeps running the old code in memory, so restart the web service after updating. Move to 8.3 or later, since 8.2 ends on 2026-12-31.
php.net · GHSA-w8hw-w9fx-j79w · NVD CVE-2026-109618 · NVD CVE-2026-109619 · CISA KEV
What we never do
No probing, no attacks, no storage
- No other paths: no /wp-admin, /phpinfo.php, robots.txt, sitemaps or favicons.
- No wordlists, HEAD/OPTIONS sweeps, form posts, cookies sent back, logins, exploit code or port scans.
- No second request to confirm, no retries.
- Addresses and results are never stored or logged, and there is no public list of checks.
- For developers: a DNS-rebinding window between our DoH check and the connection remains. Egress is Cloudflare’s network with no internal services, so the residual risk is opening an unintended public page once; the body is never returned.
FAQ
No trace · Gnuboard version · what to ask
How do I check which PHP version our website runs?
Type the address above. Our server opens that page once and reads the response headers (X-Powered-By, Server) and the marks visible in the HTML. If the server hides its version, nobody can see it from outside: your hosting provider or web agency has to check on the server.
Does “no PHP trace” mean the site is safe?
No. Many servers hide their version, and not seeing it from outside doesn't mean the site is safe. The result is an estimate, so asking your hosting provider is the sure way.
Why don't I see the Gnuboard or Youngcart version?
Gnuboard5 and Youngcart5 don't print their version in the HTML, so we only name them (from their script variables). WordPress shows a version only when its generator meta tag has one. We never guess the PHP version from the CMS.
When did PHP 7.4, 8.0 and 8.1 reach end of life?
According to php.net: 7.4 on 2022-11-28, 8.0 on 2023-11-26 and 8.1 on 2025-12-31. 8.2 gets security fixes only until 2026-12-31; 8.3 until 2027-12-31.
Which versions are affected by CVE-2026-109618 and CVE-2026-109619?
The 2026-10-21 security release is 8.2.35, 8.3.36, 8.4.27, 8.5.12; earlier 8.2–8.5 versions are affected (GHSA-w8hw-w9fx-j79w). 8.1 and older get no official update. Minimal source patches exist for 7.4, 8.0 and 8.1, but moving to a supported version is the fix.
What should I ask my hosting provider?
Copy the message under the result. It asks three things: whether the update was applied, whether the web service was restarted afterwards, and, for an end-of-life version, the schedule and cost of moving to a supported one.
Is this check hacking, or illegal?
We send one request, the same as visiting the home page in a browser (following at most 3 redirects). No admin-page hunting, no other paths, no attack requests. Only check sites you run or may check. This is not legal advice.
Is the address I type stored?
No. The address and the result are used only while checking and are never stored or logged, nor put in the page URL or browser storage. To limit checks of one site to 20 a day, a salted hash of the site name and today's count are kept for that day only.
Sources
All checked 2026-10-23
- php.net — Supported Versions
- php.net — Unsupported Branches (EOL)
- php.net — Security advisory: Critical remote code execution vulnerabilities, update now
- GitHub Security Advisory GHSA-w8hw-w9fx-j79w
- NVD CVE-2026-109618 · NVD CVE-2026-109619
- CISA — Known Exploited Vulnerabilities Catalog
- WordPress News — security releases
- php.net — expose_php · php.net — session.name
See examples first
PHP end-of-support calendar
As of 2026-10-23 · one crack per full year past the deadline
- PHP 7.4end of lifeended 2022-11-28 · D+1,425
- PHP 8.0end of lifeended 2023-11-26 · D+1,062
- PHP 8.1end of lifeended 2025-12-31 · D+296
- PHP 8.2security onlyuntil 2026-12-31 · D-69
- PHP 8.3security onlyuntil 2027-12-31 · D-434
- PHP 8.4supporteduntil 2028-12-31 · D-800
- PHP 8.5supporteduntil 2029-12-31 · D-1,165
Well-known, neutral sites
Sample results · may differ from the live site · recorded 2026-10-23. Clicking shows what we recorded that day; nothing is requested from the site now.
Why react.dev is not PHP: react.dev source repository
Fictional example: a site built on an end-of-life PHP
Fictional example · not a real site
my-shop.example: PHP 7.4 (end of life)
- X-Powered-By header
X-Powered-By: PHP/7.4.33 - PHP default session cookie name
Set-Cookie: PHPSESSID - Gnuboard5 script variable
var g5_url
- On one visit to the home page, this site gives away 4 lines of information.
- Security header report card F
- 73 security fixes released for other versions after PHP 7.4 ended · 7.4 got no official fix
my-shop.example is a reserved example address (RFC 2606). This is how a Gnuboard5 · PHP 7.4 site looks on 2026-10-23.
Recent PHP vulnerability coverage
- Known Exploited Vulnerabilities Catalog
- Critical PHP Security Release
- Security advisory: Critical remote code execution vulnerabilities, update now
- RCE via OOM corruption
- CVE-2026-109618 Detail
Titles are verbatim · checked 2026-10-23. We have not checked or judged any organisation named in these articles.