Why your PHP version matters
PHP is the programming language WordPress and most small business websites run on. Each version is
supported for a few years. After its end of life date the PHP team stops fixing security holes in
it, so anything discovered after that stays open on every server still running it.
Plenty of sites are still on PHP 7.4 or 8.0, years after support ended, usually because nobody
was asked to move them. It is rarely the business owner's fault: the site works, so nobody looks.
But outdated PHP is one of the most common ways small sites get hacked, and newer plugins
increasingly refuse to run on it, which leaves the rest of the site stuck out of date too.
October 2026 brought a live example. Two critical flaws nicknamed PHP2Shell were fixed in PHP 8.2.35,
8.3.36, 8.4.27 and 8.5.12, and PHP 8.1 and older got no official fix at all.
PHP2Shell: is your website affected?
explains what to check and what to ask your host.
What this checks
- PHP versionRead from your server's headers, compared live with the official support schedule. Hidden is a good sign.
- WordPress versionFrom the page source or RSS feed, compared with the latest release from WordPress.org.
- Plugins and themeVersions read where visible and compared with WordPress.org. Plugins pulled for security reasons are flagged.
- Exposed files.env settings files, .git folders, wp-config backups and WordPress error logs left readable. We never read or keep their contents.
- WordPress exposureWhether login usernames can be listed, XML-RPC is on, and the uploads folder can be browsed.
- The basicsHTTPS and the redirect to it, SSL certificate expiry, and four key security headers.
What it does not do
This is a passive check. It makes about twenty ordinary page requests, the same as a visitor's
browser, and reads what your site already shows anyone. It never tries to log in, never submits a
form and never sends anything designed to break in. It identifies itself honestly as
BAVTechSecurityCheck, so it will show up as that in your logs.
It also does not look up individual CVE numbers against your PHP version. Hosts on Ubuntu, Debian
or Red Hat often patch PHP without changing the version number, so a CVE list would wrongly call
well maintained servers vulnerable. Instead you get the question that actually matters: is this
version still getting security fixes, and have they been installed?
Questions
Is this security check free and safe to run on my site?
Yes. It is free with no sign-up. It is a passive check: it only makes the same kind of ordinary page requests a visitor's browser makes, about twenty of them, and reads what your site already shows the public. It never tries to log in, never submits a form and never sends attack traffic. Please only check sites you own or look after.
How can you tell which PHP version my website runs?
Many servers announce it in a response header called X-Powered-By, for example PHP/7.4.33. We compare that against the official PHP support schedule, fetched live from endoflife.date, so the result is always current. If your server hides the version, we report that as a good sign, because hiding it is recommended practice.
What makes a PHP version vulnerable?
Each PHP version gets security fixes for a few years and then reaches end of life. After that, the PHP team stops fixing it, although some hosts and Linux distributions keep backporting fixes for a while, which cannot be seen from outside. We mark end of life versions red, and ask you to check with your host. A Linux distribution build that has only recently passed end of life is amber, because it may still be patched. Versions about to reach end of life or behind on their security updates are amber, and supported up to date versions green. We do not match against lists of individual CVEs, because hosts on Ubuntu, Debian or Red Hat often patch PHP without changing the version number, and that would wrongly flag well maintained servers.
What does the WordPress part check?
If your site runs WordPress, the check works out the WordPress version from the page source or RSS feed and compares it with the latest release from WordPress.org. It finds the plugins and theme your pages load, reads their versions where they are visible, and flags any that are out of date or have been removed from WordPress.org for security reasons. It also checks whether usernames can be listed, whether XML-RPC is switched on and whether your uploads folder can be browsed.
If my site comes back green, is it secure?
Not necessarily. An outside scan can only see what your site shows the public. It cannot see your hosting account, admin passwords, backups, file permissions or malware hidden in the database. A green result means nothing obvious is out of date or exposed, which is a good start, not a guarantee.
Why do you ask for an email address for the full report?
The overall rating and the list of findings are free and shown straight away. The full report adds what each finding means, why it matters and how to fix it. Enter your email and it appears on the page immediately. Bhavesh gets a copy so he can help if you ask. It is not a mailing list.
Can you fix the problems for me?
Yes. Updating PHP, WordPress and plugins safely, closing exposed files and tightening settings is everyday work for BAV Tech Solutions in Bolton. Start with the £149 Website Health Check, which is credited against the work if you go ahead, or a monthly support plan that keeps everything updated for you.