Who hosts my WordPress website? How to find out in five checks

Three companies can sit behind your website: the hosting company you pay to keep it online, the developer or web company that built it, and the domain registrar, which is the company you pay for your web address. Sometimes one company does all three. You can usually find each of them with five checks: your invoices, your email, the Users screen in WordPress, a public lookup of your web address, and a question to whoever pays the bills.

Why does it matter who hosts your website right now?

On October 21, 2026, the PHP project released fixes for two critical security bugs in PHP, the software WordPress runs on, behind the scenes (php.net). WordPress.org says "No WordPress update is required or planned for these issues," and tells owners to check with their web host (WordPress.org). So the fix has to be installed on the server, the computer your website lives on, by whoever runs it.

If you pay a hosting company (GoDaddy, Bluehost, SiteGround, and so on) for a plan, they update PHP. If you or a developer rent a server of your own, that job falls to you or to them (Wordfence). Either way, you can't ask the right person until you know who that is. For the rest of the story and what to check, see our WordPress advisory page.

Who's who behind your website?

How do you find out who hosts your website?

Work through these in order and stop when you have a name.

1. Invoices and card statements. Search for "hosting," "domain," "WordPress," or the name of a web company. Whoever gets paid for hosting is usually your hosting company. If the only charge is a monthly fee to a marketing company, they may be paying for hosting on your behalf.

2. Your email. Search for "renewal," "hosting," "domain," and "cPanel" (a control panel many hosting companies use). Renewal notices are easy to miss when they go to whoever set the website up, so search the office inbox too.

3. WordPress, if you have a login. Go to Users. WordPress lists each user's name, email address, and role (WordPress.org). Look at the Administrator accounts: an email address at a web company is a strong hint about who built or maintains your website. Then go to Tools, Site Health, Info, and open Server. You'll see your PHP version (WordPress.org) and the web server software. That sometimes points to the hosting company, but it doesn't always name one.

4. A lookup of your web address. ICANN, the organization that coordinates web addresses, runs a lookup tool that shows "the current registration data for domain names" (ICANN Lookup). Type in your web address. The record names your registrar and lists your name servers, which control where your web address points. Your registrar can tell you where that is, and that tells you who to ask next.

5. Your office. Ask whoever pays the bills. Here's a note you can send:

Subject: Who runs our website?

Hi [Name],

Do you know who hosts our website [yourdomain.com] and who built or maintains it? Any of these would help: an invoice or card charge for hosting, a domain renewal notice, or emails from a web company. Please send me the company name, a contact, and who gets the bill.
Thank you,
[Your name]

What if the trail ends at a web company?

If you pay one company each month for "website and marketing," they may host your website themselves or rent hosting from someone else. You don't need to know which before you ask. Ask them in writing who hosts [yourdomain.com], who is responsible for keeping PHP up to date there, and which PHP version the website runs now. If they can't tell you, ask who can.

The same goes for a relative or former employee who built it. They may still hold the hosting login.

How do you keep this from happening again?

Write it all down in one place the office can find, so the next time a security notice like this comes out, nobody has to dig through old invoices. Leave passwords out of the note.

WHO RUNS OUR WEBSITE (updated [date])

Web address: [yourdomain.com]
Domain registrar: [company], account held by [name], renews [date]
Hosting company: [company], plan [name], account [number], support [phone or link]
Built or maintained by: [company or person], [name, email, phone]
WordPress administrators: [names and emails]
PHP version: [number], checked [date]
Who pays the bills: [name]

An administrator account nobody recognizes is worth asking about. Our post on signs a WordPress website may have been compromised explains what to do.

What do you send once you have a name?

Ask for a written answer to three questions: which PHP version your website runs, whether it includes the October 21 fix, and if not, when it will. Our messages to send your hosting company are ready to copy, with versions for a web agency and the person who built your website.

Get it in writing because some hosting companies install the fix without changing the version number your website shows (Wordfence). And whoever you reach, don't try to fix this with a plugin or by editing files on the server yourself. Updating WordPress, plugins, or themes doesn't install a PHP fix (WordPress.org).

Who is The Graphite Lab?

The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. If you decide it's time for a new website, the first draft is ready for your review within 10 business days of payment.