PHP Site AuditHosting and runtime checks
How do I check my PHP version in cPanel or Plesk?
Use your hosting panel's domain-specific PHP settings or ask support to identify the web runtime for that hostname. A terminal command such as php -v may describe only the command-line binary, which can be different from the version serving the website.
Start with the domain-to-runtime mapping
A control panel can manage more than one website, subdomain, PHP version or handler. Sign in using the account that controls the domain, open the PHP settings for the exact hostname, and note the assigned version and handler shown there. Panel labels change over time, so use the current help pages for your panel rather than relying on an old screenshot or menu name.
If the panel exposes only a general account version, that may not settle what a particular virtual host is using. Ask support to confirm the mapping between the requested hostname, its document root, PHP handler, pool or process manager, and installed package. Include both the apex domain and any www or application subdomains that serve dynamic requests.
Why the terminal version can mislead
php -v normally runs the CLI executable found in that shell's path. A website may instead use PHP-FPM, Apache mod_php, CGI/FastCGI, LiteSpeed or a container. A host can install several versions at once, leaving command-line automation and the web server on different builds. CLI output is useful only after the administrator confirms it is the binary and package attached to the web runtime.
Likewise, a phpinfo() page can reveal configuration for the request that executes it, but it is sensitive and should not be left publicly accessible. Do not publish a diagnostic page just to check a version. Ask the provider for evidence through its support channel or use a temporary, access-controlled check that the administrator removes immediately.
Ask for patch evidence, not a single number
Use PHP's October 21 advisory and the related fixed-version guide for the current upstream release list. A distribution or managed host may backport fixes while retaining a different version label. Ask which vendor package is installed, which advisory or build contains both fixes, when the serving workers restarted, and whether any separate older pool still receives traffic.
Save the support reply and package reference with your maintenance record. If the answer gives only a generic panel version, ask whether it reflects the web SAPI and whether the vendor has applied the CVEs. A public banner is not a substitute for this evidence, and neither an old-looking banner nor a hidden banner proves the package's actual patch state.
Common questions
Is changing the PHP version in the panel always enough?
It may switch the domain to a patched build, but confirm the target package, worker restart, and application compatibility with the host.
Can I create a public PHP version page?
Avoid leaving one exposed; it can disclose configuration and still may not identify every pool or upstream package.
What should I send support?
The exact hostname, the CVE identifiers, the panel version shown, and a request for the web-serving package/backport and restart evidence.