How to check your WordPress website's PHP version, step by step
Where to find the number in WordPress or your hosting account, what it means for the October 21 fix, and why your hosting company has to confirm it.
To see your PHP version (PHP is the software WordPress runs on, behind the scenes), log in to WordPress and go to Tools, then Site Health, then the Info tab, and open the Server section. The number tells you whether your website has the fix released on October 21, 2026, is still waiting for it, or is on a version that no longer gets fixes. It can't prove the fix is installed, so the last step is a written answer from your hosting company, the company you pay to keep your website online.
Why does the PHP version matter right now?
The two critical bugs fixed on October 21 are in PHP, not in WordPress, so WordPress.org says no WordPress update is needed for them (WordPress.org). The fix arrived as new PHP versions. Your version number is the quickest clue to whether your website has it.
How do you find the PHP version in WordPress?
WordPress.org gives this path in its October 21 notice (WordPress.org):
-
Log in to your WordPress dashboard.
-
In the left menu, click Tools, then Site Health.
-
Click the Info tab at the top of the page.
-
Open the section called Server.
-
Find the PHP version line. Write down the whole number, all three parts, and the date you checked.
If Tools has no Site Health entry, your login may not have administrator rights. Ask whoever set up your website, or try your hosting account.
Can you check it in your hosting account?
Usually, yes. WordPress.org notes that many hosting companies show the PHP version in their own admin panel too (WordPress.org). Look for a heading like "PHP" or "Select PHP Version." If the account holds more than one website, make sure you're looking at the setting for yours.
If the panel shows only two parts, such as 8.3, that's not enough to judge the fix. Use Site Health, or ask your hosting company for the full number.
If you can't get into WordPress or the hosting account at all, start by finding out who runs your website. Our post on what to send your hosting company covers that.
What does each part of the number mean?
A PHP version has three parts. In 8.3.36, "8.3" is the series and "36" is the update number within that series. PHP released the October 21 fix as a new update on each series it still supports (php.net):
| If your first two parts are | The fix starts at |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1, 8.0, 7.x, or older | No fix from the PHP project |
Read the last part as a whole number, not a decimal. 8.3.4 is older than 8.3.36, because 4 is less than 36. 8.3.31 is older too. 8.4.27 matches its row, and 8.4.28 would be newer.
What should you do with your number?
| What Site Health shows | What it means | What to do |
|---|---|---|
| 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or higher in the same series | The official fix is installed. | Keep a note of the number and the date. |
| 8.2, 8.3, 8.4, or 8.5 with a lower last number | The number doesn't show the fix. | Ask your hosting company whether it has fixed your version another way, and when the official fix lands. |
| 8.1, 8.0, 7.x, or older | The PHP project no longer fixes these. Only your hosting company or its software supplier can. | Ask your hosting company, and ask to move to PHP 8.3 or newer. |
Two dates are worth knowing. WordPress recommends PHP 8.3 or newer (WordPress requirements), and PHP 8.2 stops getting fixes on December 31, 2026 (php.net). A website on 8.2 can get this fix, but its series has about ten weeks of support left.
For scale, 36.4% of WordPress sites that report their PHP version run 8.1 or older, and 19.8% are still on PHP 7 (WordPress.org stats, fetched October 21, 2026). That isn't a count of exposed websites. The stats show the series, not the update number, and hosting companies can fix older versions themselves.
Why can't the number alone prove the fix?
Some hosting companies fix PHP without changing the version number your website shows. Wordfence, a WordPress security company, warns that when PHP comes from a server software supplier, the number may not change after the fix, so you should confirm with your hosting company (Wordfence).
Here's a real example. As of October 21, 2026, cPanel, the control panel many hosting companies use, had copied the fix onto its own PHP 7.4, 8.0, and 8.1, versions the PHP project no longer fixes (cPanel). A website showing 7.4 at a hosting company using that update could have the fix.
So a low number doesn't prove your website is exposed, and only your hosting company knows exactly what it runs. The step that settles it is a short written question: which PHP version does my website use, and does it include the fix for CVE-2026-109618 and CVE-2026-109619? Those two codes are the official IDs for the bugs, so support staff know exactly which fix you mean. The full message is in our post on what to send your hosting company and on our WordPress advisory page.
What if you're on PHP 8.1 or older?
Ask your hosting company to move your website to PHP 8.3 or newer, after a full backup. Old themes and plugins can break on a newer PHP version, so check your website right after the switch, or have your web person test a copy first (WordPress PHP compatibility).
Leave server settings to your hosting company or developer. PHP lists some stopgap settings for people who can't update yet, and says they "do not make an installation safe" (php.net).
Who is The Graphite Lab?
The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to, and there's no PHP version for you to look up. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. If you're thinking about a new site, the first draft is ready for your review within 10 business days of payment.
Want to see this on your board?
Book a 30-minute call and we’ll walk through it live.