PHP Site AuditVerification
How to verify which PHP version actually serves your website
A server's php -v command reports the PHP CLI binary selected in that shell. A website may use a different PHP build, pool, container, or host. Confirm the web-serving runtime through the hosting panel or administrator, then verify the deployed package and restart state; public headers alone cannot prove it.
Why `php -v` can be misleading
Many servers install separate PHP binaries for command-line jobs and web requests. A shell may select one binary from its PATH while Apache, PHP-FPM, a container, or a hosting account uses another. Multiple pools or sites can also be assigned different PHP branches. Updating the command-line package therefore does not by itself prove the website is updated.
Do not publish a temporary phpinfo() page to check the result. PHP documents that it can expose version, configuration, environment, paths, request variables, and headers. Use the control panel's runtime selector, a provider support ticket, or an authenticated administration channel.
Evidence that closes the loop
Record the domain and hostname, PHP SAPI or managed runtime, branch/package or container identifier, vendor advisory that confirms the fix, and time the web worker was restarted. On a self-managed server, the owner can compare the package installed in the actual image or VM with the PHP advisory and verify service health after restarting the correct service.
Then check the site through its normal public URL for basic functionality. That confirms the service responds after deployment; it does not reveal the binary's patch contents. Keep the package or image evidence alongside the change record.
Ask the operator to compare the response-serving handler with the installed package inventory and process manager. If a site sits behind a CDN or load balancer, confirm that each origin and region uses the intended runtime rather than relying on one request that may reach only one node.
Use a public banner only as a clue
An X-Powered-By header may show a PHP version, but PHP allows administrators to suppress it and intermediaries can alter headers. Its presence is a disclosure signal; its absence is not evidence of a current runtime. A scanner that only reads headers should report what it observed and ask for server-side confirmation.
Common questions
Why can php -v differ from the website?
A shell may select a CLI executable while the web server uses another SAPI, pool, container or package.
Can a temporary version page help?
It may show request configuration, but it is sensitive; restrict and remove it promptly, and do not treat it as package proof.
What if a site has several hostnames?
Ask the administrator to map each hostname to its handler, pool or image; a result for one route may not cover another.