Where to check and change your PHP version, host by host
Where to see your real PHP version, whether PHP2Shell means you must switch, and where Hostinger, Bluehost, GoDaddy, SiteGround, Kinsta and WP Engine keep it.
By Jeensuk Yang
PHPFree · Web security · Fix series 02
?Who this is for
- Someone told you to "check your PHP version," and you don't know where to click
- You're not sure whether PHP2Shell means you have to change versions now
- You want to know where the setting lives at your host before you touch it
!What you'll learn
- Where to see the PHP version your site really runs
- Whether you need to change it now, and which version to move to
- Where the PHP setting is at six major US hosts, and the traps before you switch
Start by learning how to read it.
"Check your PHP version" sounds simple until you try. Where do you click? What does the number mean? Will changing it break the site? Take it in order and it isn't hard: first where to look, then whether you need to change anything, and finally where each host keeps the setting. I've checked each host's own help pages for this guide.
Where do you see the PHP version your site really runs?
In your WordPress dashboard, go to Tools → Site Health → Info → Server and look at the PHP version line. It's a read-only screen, so nothing changes when you look.1
Some guides tell you to upload a phpinfo file to see the version. That file shows your server's details to anyone, so delete it right after. WP Engine says to "delete the file as soon as possible after use, for security reasons."2
There's one more trap: the number itself. A car's model year doesn't tell you whether it got the recall repair. You need the service record. PHP is the same. Red Hat says "just looking at the version number of a package will not tell them if they are vulnerable or not,"3 and Ubuntu's fixed package for 24.04 LTS is still labeled 8.3.6, with the fix shown only in the tail: 8.3.6-0ubuntu0.24.04.13.4
- Look: check the PHP version under Tools → Site Health → Info → Server
- Read: check your host's notice to see whether your version got the fix
- Decide: if your version's support is ending, pick a date and a target version
- Prepare: back up, update plugins, and check whether the switch is a click or a move
- Switch and check: make sure pages, forms and posting still work
Steps 1 and 2 take about ten minutes today. From step 3 on, set a date and take your time. This guide is current as of October 25, 2026; host screens change, so check the help page linked for your host.
Jeensuk's takeThe number tells you the model year. The host's notice tells you whether it got the repair. Look at both.
Does PHP2Shell mean you have to change versions now?
On shared or managed hosting, usually not right now. But if you're on PHP 8.2 or older, set a date to move before the year is out.
Hostinger said every plan except VPS needed no action,5 and Kinsta patched PHP 7.4 through 8.5 for its customers.6 Your host's notice is the first thing to read.
PHP 8.2's security support ends on December 31, 2026.7 If you move to 8.2 now, you'll have to move again in two months. That's like moving into an apartment with two months left on the lease.
WordPress lists PHP 8.3 or greater as its recommendation.8 Which versions you can pick depends on your host: Hostinger, for example, no longer offers anything below 8.2.9
Jeensuk's takeBetween "right now" and "someday" there's "this year." It isn't urgent, but put one date on the calendar.
Where do you change the PHP version at each host?
At most hosts, you change it in the hosting dashboard. Menu names and timing differ, so find your host in the table below.
| Host | Where to change it | Good to know |
|---|---|---|
| Hostinger | Websites → Dashboard → PHP Configuration → choose a version → Update | Applies "within a couple of minutes." Downgrading isn't possible except within the same login session9 |
| Bluehost | Bluehost Portal → Hosting → My Plans → cPanel → Software → MultiPHP Manager → select domains → PHP Version → Apply | A domain marked "Inherited" follows the system PHP version10 |
| GoDaddy | Products page → Web Hosting → Manage → Settings → Server Settings → Change next to PHP Version → Continue → Save Changes | Web Hosting (cPanel). If something breaks, pick your previous version again11 |
| SiteGround | Site Tools → Devs → PHP Manager → pencil icon → Change PHP version | Choosing a version yourself turns off SiteGround's automatic PHP updates12 |
| Kinsta | Sites → your site → Tools → PHP settings → Change | Usually "within 3 minutes or less." Clear the cache afterward13 |
| WP Engine | Sites → environment → Updates → PHP → PHP Selector → new version → confirm | Changes "in just a few moments." Set separately for each environment2 |
Jeensuk's takeIf you can't find the menu, ask your host's support, "Where do I change my PHP version?" That's a perfectly good first step.
What traps should you know about before you switch?
Some hosts won't let you go back down, and some change the version for you. Know which kind yours is before you click.
At one host, changing PHP is rearranging the furniture. At another, it's a door that only opens one way. Find out which before you walk through.
- Hostinger: "Downgrading to lower versions is not possible (except within the same login session if an issue occurs)." The version you pick applies to every site on the plan, except those built with its AI Builder.9
- Bluehost: if a domain shows "Inherited," it isn't set on its own; it follows the system version. Check each domain you care about.10
- SiteGround: with Managed PHP, SiteGround moves you forward when a newer version is stable. If you choose a version yourself, "your PHP version will not be automatically updated by us."12
- Kinsta and WP Engine: both upgrade sites automatically when a PHP version reaches end of life. At WP Engine, "Automatic PHP upgrades cannot be deferred."13·2
When a PHP version reaches its end of life, we automatically upgrade your site to the latest supported version. — Kinsta Docs, updated May 28, 2026
Automatic upgrades are convenient, but they also mean your site can change versions while you're not watching. Keep your theme and plugins up to date so an automatic move doesn't catch you out.
Jeensuk's takeThe same words, "change the PHP version," mean a one-way door at one host and an automatic move at another. Read your host's page before you press the button.
What should you check on a VPS or your own server?
Look in the PHP package's changelog for the CVE number, and restart PHP-FPM and the web server after updating. Pass this section straight to whoever runs your server.
- Ubuntu and Debian:
apt-get changelogshows the changelog of an installed package.14 On Ubuntu, the main number stays the same and the fix shows in the tail of the version string.4 - Red Hat–family systems: the version number alone won't tell you whether a package is vulnerable,3 so ask your administrator to confirm the fix in the package changelog or security advisories.
- Restart: Hostinger's advice to anyone running their own PHP was "update it and restart it now."5
Jeensuk's takeYou don't need to memorize commands. Ask whoever runs your server two things: "Did you confirm CVE-2026-109618 in the changelog?" and "Did you restart?"
What should you check after changing the version?
Make sure pages load and that your contact form, file uploads and posting still work. Then open Site Health again.
WordPress says to back up and bring WordPress, your theme and plugins up to date before changing PHP, and to get help if something doesn't work.15 GoDaddy says to confirm your site works after the change, and if it doesn't, pick your previous version again.11 Kinsta adds that you may need to clear your site's cache to see changes.13 Back in Site Health, check that no warnings are left.1
If the screen goes white, follow the steps in "White screen after a PHP upgrade?" in this series (English edition coming soon).
Jeensuk's takeChanging the version takes a few minutes. Spend thirty checking. Don't let your customers be the ones who find the problem.
Frequently asked questions about checking and changing PHP by host
Do I need to change my PHP version because of PHP2Shell?
On shared or managed hosting, usually not. Many hosts patched it for their customers, so read your host's notice first.
Which version should I move to?
PHP 8.3 or newer. PHP 8.2's support ends on December 31, 2026, so you'd have to move again soon.
The version number didn't change. Was it still fixed?
It can be. Some vendors put the fix into the old number, so check your host's notice or the package changelog instead of the number alone.
SOURCES
- WordPress.org, "Site Health screen" (updated Jul 12, 2026) wordpress.org
- WP Engine, "PHP Upgrade Guide" (updated Jul 12, 2026) wpengine.com
- Red Hat, "Security Backporting Practice" redhat.com
- Canonical, "USN-8948-1: PHP vulnerabilities" (Oct 21, 2026) ubuntu.com
- Hostinger, "Hostinger deploys protections against php2shell PHP vulnerabilities" (Oct 21, 2026; updated Oct 23) hostinger.com
- Kinsta, "PHP2Shell: How Kinsta protected WordPress sites" (Oct 23, 2026) kinsta.com
- PHP Group, "Supported Versions" php.net
- WordPress.org, "Requirements" (updated May 7, 2026) wordpress.org
- Hostinger, "How to change the PHP version of your Hostinger hosting plan" (updated Oct 22, 2026) hostinger.com
- Bluehost, "How to Use MultiPHP Manager" (updated Nov 18, 2025) bluehost.com
- GoDaddy, "View or change the PHP version for my Web Hosting (cPanel)" godaddy.com
- SiteGround, "What Is Managed PHP Service and How to Enable It?" (updated Nov 28, 2025) siteground.com
- Kinsta Docs, "Restart and Update PHP" (updated May 28, 2026) kinsta.com
- Debian Manpages, "apt-get(8)" manpages.debian.org
- WordPress.org, "Update PHP" (updated Jul 29, 2026) wordpress.org
The fix guide covers the whole order; each article goes into one step. More English editions are on the way.
- PHP vulnerability fix guide: from checking to moving off PHP (coming soon)
- White screen after a PHP upgrade? How to fix and roll back (coming soon)
- Where to check and change your PHP version, host by host (this article)
- Is there a back door left on your site? A self-check for web shells (coming soon)
- Moving WordPress to a static site: how and what it costs (coming soon)
To understand what went wrong, start with risk series part 1, "What is PHP2Shell?" More articles on the ATATAKAI Digital blog.
Not sure which version you're on?
Enter your site address and we'll tell you right away whether it runs on PHP and where your host stands. If you're not affected, we'll say so plainly: "No need to move right now."
Run the free 30-second checkWant to talk it through after you see the result? Contact ATATAKAI Digital
Updated Oct 26, 2026
