How to check your PHP version and what your website runs on

When news breaks about a vulnerability in PHP, Node.js or a popular plugin, the first question is: does this affect my website? The answer depends on a few version numbers that are rarely written down anywhere. Without them you can’t assess the risk, and a conversation with your host or contractor starts with an exchange of emails full of questions.

In this guide I show how to check your PHP, Node.js, CMS and plugin versions, mostly without a developer, and how to write everything down in one short fact sheet. As of 6 November 2026. Support dates and patched versions may change, so check them on the vendor’s website before making a decision.

Four things you need to know about your website

Every website is several layers of software. Each has its own version number and its own security fixes, and a vulnerability usually affects only one of them.

1. The web server, that is, the program that sends the website to the browser: most often nginx, Apache or LiteSpeed.
2. The language the website runs on: PHP (WordPress, WooCommerce, PrestaShop, Joomla) or Node.js (Next.js, Nuxt, Express).
3. The CMS or framework: WordPress, PrestaShop, Next.js and similar.
4. Add-ons: plugins, the theme, store modules and libraries.

On shared hosting, the web server is usually handled by the host, you often choose the PHP version yourself in the panel, and the CMS and plugins are the business of the website owner or the contractor. I describe the division of duties in the guide on who is responsible for website updates.

Method 1: the hosting panel and the website panel

This is the most reliable method, because you see the data from the inside instead of guesses.

Hosting panel

Log in to your hosting panel and look for an item such as “PHP version” (Wersja PHP), “PHP configuration” (Konfiguracja PHP) or “PHP and Node.js”. In cPanel, the tool for this is MultiPHP Manager, which shows the PHP version next to each domain. I described the exact paths for OVHcloud, home.pl and nazwa.pl in the guide on the end of PHP 8.2 support.

The panel often shows only the branch, for example 8.3. For vulnerabilities, what counts is the full release number, for example 8.3.x, because a fix goes into a specific release. You will see the full number in the CMS panel, or you can get it from your host.

A website on Node.js usually runs on a VPS or on a platform such as Vercel or Netlify. The Node.js version is then visible in the project settings or in its files, so the easiest thing is to ask your contractor (a ready message is below).

WordPress and WooCommerce

• Dashboard → Updates shows the WordPress version and the plugins and themes waiting for an update.
• Tools → Site Health → Info is the most convenient place. The “WordPress” section has the system version, the “Server” section the full PHP version and the server software, and the “Active Plugins” and “Inactive Plugins” sections list every plugin with its version number.
• Plugins → Installed Plugins shows versions and whether automatic updates are on.

The “Copy site info to clipboard” button on the same page gives you a full set of data to paste into an email. Send it only to someone you trust, because it contains technical details of the server.

If you see a “PHP Update Recommended” box in the dashboard, WordPress itself is telling you that the PHP on the server is too old. According to wordpress.org, PHP 8.3 or newer is recommended today.

PrestaShop

In the PrestaShop back office, go to Advanced Parameters → Information (in the “Configure” group of the menu). There you will see the PrestaShop version, server details, and the PHP and database versions. You can check module versions in Modules → Module Manager.

Method 2: what the website reveals from the outside

This method works without logging in, but you only see what the website itself shows. If it hides versions well, you won’t learn much, and that is actually good news.

Server headers

Every server response has headers, a short fact sheet that is not visible on the page. Two of them tell you about the software:

• Server: nginx and Apache in their default settings give the name and version number here, for example nginx/1.24.0.
• X-Powered-By: PHP in its default settings puts its version here, for example PHP/8.3.x. Express puts Express, and Next.js Next.js, in both cases without a number.

How to view them in Chrome: press F12, open the Network tab, refresh the page, click the first item on the list and find the response headers. Some hosts hide version numbers, so an empty result doesn’t settle anything.

Page source code

Press Ctrl+U, then Ctrl+F and type generator. By default WordPress inserts a tag with the version number into the code, for example:

<meta name="generator" content="WordPress 7.1.4">

File addresses give away the rest: /wp-content/plugins/plugin-name/ shows plugin names, /_next/static/ means Next.js, and /_nuxt/ Nuxt. Security plugins often remove the generator tag, so its absence proves nothing.

Browser extension

The fastest way to identify the technologies is with the Wappalyzer or BuiltWith extension (both are available for Chrome and Firefox). After clicking the icon you see the CMS, framework, server and libraries. This is identification based on traces: they show the version only when the website reveals it, and they are sometimes wrong.

Bots that search the web for websites with old versions see the same thing, which is why it’s worth making sure the server doesn’t give out numbers. This is not full protection (the Express documentation says outright that a skilled attacker will identify the software anyway), but it makes simple scanning harder.

Check your website

My free tool Check your website does part of this work for you. It warns you when the Server or X-Powered-By header contains a version number and suggests hiding it. It also identifies the platform from the generator tag and file addresses (including WordPress, WooCommerce, PrestaShop, Shopify, Shoper and Next.js) and shows it next to the result. It does not, however, read the CMS version or the list of plugins, and it doesn’t log in to the panel, so it won’t replace checking from the inside.

Where to find the versions: a table for popular websites

Is your PHP or Node.js version still supported

The number alone says little. What matters is whether the vendor still releases security fixes for that version. As of 6 November 2026, according to the supported versions table on php.net and the Node.js release schedule:

Node.js 27 is still only in the testing phase (alpha). According to nodejs.org, production servers should use only versions with long-term support (LTS).

The second thing is the full number. Fixes for PHP 8.3 go into successive 8.3.x releases, and when the vendor announces a vulnerability, it gives the versions with the fix. Yours must be the same or newer. On shared hosting, new releases within a branch are usually installed by the host, but it’s worth confirming this by email.

For WordPress plugins, you can enter the name and version in the Patchstack vulnerability database or in the Wordfence database. You will see known vulnerabilities and the version in which they were fixed.

What to do today: a website fact sheet in 15 minutes

Write the results down in one place. The next time there is news about a vulnerability, you will check in a minute whether it affects you. A template to copy:

Website: yourcompany.pl Hosting and plan: … Who updates: CMS and plugins …, server and PHP … Web server: … (version, if known) PHP or Node.js: … (full number) CMS or framework: … (version) Plugins, theme, modules: name and version of each Date checked: …

Then go through this list:

1. Compare the PHP and Node.js versions with the table above. A version without fixes is the first job to hand off.
2. Update the CMS and plugins, starting with a backup. I described the order in the guide on updating WordPress safely.
3. Remove plugins you don’t use. WordPress itself warns in Site Health that inactive plugins are an easy target.
4. Check your plugins in a vulnerability database, especially ones that haven’t been updated for a long time.
5. Run the website through Check your website and see whether the server gives away versions.
6. Put a fact sheet review in your calendar once a month.

What to ask your host or contractor to do

If you can’t find something, or the website runs on Node.js, send a short message:

Hello, please let me know what software the website yourcompany.pl runs on: the full PHP or Node.js version, the CMS or framework version, the list of plugins or dependencies with versions, and the web server version. Please also tell me who installs security fixes and how quickly, and whether the server hides version numbers in the headers. Thank you.

A contractor with access to the server will check this with a few commands:

curl -sI https://yourcompany.pl | grep -iE "^(server|x-powered-by):"
node -v
npx next -v
php -v

Note: php -v shows the PHP version used in the console. On hosting with several versions it can differ from the website’s version, so Site Health or the hosting panel is more reliable.

Version numbers are usually hidden in the configuration: expose_php = Off in PHP, server_tokens off; in nginx, ServerTokens Prod in Apache, poweredByHeader: false in Next.js and app.disable('x-powered-by') in Express. On shared hosting, some of these settings can only be changed by the host.

If it turns out that the website has a vulnerability, you will find an action plan in the next guide in this series: “Business website vulnerability: what to do in the first 24 hours”.

When a serious vulnerability appears in PHP, the version matters right away. I describe an example and an action plan in PHP vulnerability (PHP2Shell): what to check and ask your host to do.

Summary

You will answer the question “does this vulnerability affect me?” in a minute if you have four things written down: the server, the PHP or Node.js version, the CMS version and the list of add-ons. You will find most of it in the hosting panel and the WordPress dashboard, and Check your website or an email to your contractor will fill in the rest.

If you would rather have someone keep an eye on this for you, choose technical maintenance. In the Watch plan (from PLN 149 net a month) I monitor your website, make backups and install security updates, and every month I send a report. The Standard (from PLN 349 net a month) and Pro (from PLN 749 net a month) plans add more frequent backups and updates, work hours each month and a faster response. If you want to check how well your website withstands typical attacks, order a security audit (from PLN 990 net) or write to me. I reply within 24 hours.