The PHP version decides which security fixes your site has and how long it will keep getting them. WordPress shows it in the dashboard, but there are five other places to look, and they don't always agree. Here's each one, which to trust, and how to read the number.
1. In the dashboard
Go to Tools → Site Health → Info and open Server. The PHP version listed there is the one running your site, and that's the one that counts.
WordPress also shows administrators a dashboard notice titled "PHP Update Recommended" or "PHP Update Required" when it considers your version too old.
2. In your host's control panel
On shared hosting, the host sets PHP, often per site. Most control panels show the version and let you change it. In cPanel, it's under MultiPHP Manager. If your host changes the version for you, check Site Health afterwards to confirm the site picked it up.
3. With WP-CLI
wp cli info
The PHP version: line is the PHP that WP-CLI runs on, which isn't always the one serving your site. On a server with several PHP versions installed, the command line can use a different one from the web server. In Docker, the official wordpress:cli image is a separate container with its own PHP, built on php:8.3-alpine (Dockerfile). So docker compose run --rm wpcli wp cli info tells you about the WP-CLI container, not your site.
4. In the container or on the server
If WordPress runs in Docker, ask the WordPress container. Use your own service name if it isn't wordpress:
docker compose exec wordpress php -v
In the official images, the command-line PHP and the PHP that serves pages come from the same build, so this matches what the site runs. On a server where PHP comes from your distribution's packages, php -v shows the default command-line PHP. PHP-FPM can be a different version, so ask the FPM binary your web server uses, for example php-fpm8.3 -v on Debian and Ubuntu.
5. In the response headers
curl -sI https://your-site.example | grep -i x-powered-by
X-Powered-By: PHP/8.3.35
PHP sends this header unless expose_php is turned off, and the official Docker images leave it on. No output means someone hid it, in php.ini, in nginx with fastcgi_hide_header, in a security plugin or at a CDN. A cache in front of the site can also keep showing the version from before an update.
Anyone can read this header, so it tells attackers which PHP you run. Once you know your version, consider turning it off with expose_php = Off (PHP manual).
6. With a phpinfo page
Create a file called info.php in the site's root with this one line:
<?php phpinfo();
Open it in your browser, read the version at the top, then delete the file straight away. It shows anyone who finds it a lot about your server.
Which one to trust
Trust the dashboard, or php -v inside the WordPress container. Both report the PHP that runs your site. WP-CLI and the command line on a server can report a different PHP, and the header can be hidden or cached.
Reading the number
A version like 8.3.35 is branch 8.3, release 35. PHP gives security fixes to four branches (supported versions):
| Branch | Security fixes until |
|---|---|
| 8.2 | 31 December 2026 |
| 8.3 | 31 December 2027 |
| 8.4 | 31 December 2028 |
| 8.5 | 31 December 2029 |
Anything older is end of life. PHP 8.1 stopped getting releases on 31 December 2025 (end-of-life branches). WordPress recommends PHP 8.3 or greater (requirements).
Within a branch, you want the newest release. On 21 October 2026, PHP released fixes for two critical flaws, known as PHP2Shell, in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A lower number on the same branch doesn't have them.
One exception: a number with a suffix, like 8.1.2-1ubuntu2.27, comes from a Linux distribution. Distributions backport security fixes without changing the upstream number, so the number alone can't tell you which fixes are in. Check your distribution's security notices instead.
If you need to move to a newer branch and WordPress runs in Docker, see How to update PHP in a WordPress Docker container. To check a version against PHP2Shell, paste your php -v output into our free check.