Zensifi.AI Security Tools · For U.S. businesses
Does my website
use PHP?
A worldwide critical security issue in PHP lets attackers take over web servers. Small businesses, agencies and e-commerce stores across the U.S. can check their website in seconds and get a ready-to-send note for their web host. Free, no sign-up, nothing stored.
- ✓ Free for U.S. businesses
- ✓ No sign-up
- ✓ Nothing stored
- ✓ Sources: NIST NVD, CISA, php.net
The scale of the problem
~3 in 4
websites with a known server language run PHP (W3Techs)
9.2
"Critical" severity score in the NIST National Vulnerability Database
Every
WordPress, Drupal, Joomla and Magento site on an unpatched server is in scope
- CISA: "Critical Vulnerabilities in PHP Require Immediate Patching."
- The PHP Project says there are no complete temporary mitigations; updating is the fix.
- NIST NVD rates the flaw critical: attackers can take over a server remotely.
That's why Zensifi built this checker and made it free for every business. No catch, no sign-up.
Platform guides
WordPress USES PHP
Self-hosted WordPress runs on PHP. Ask your host to move to a fixed PHP version; update WordPress core, themes and plugins first if they block newer PHP. WordPress.com is maintained for you.
WooCommerce USES PHP
WooCommerce is a WordPress plugin, so your store runs on PHP. Treat checkout servers as high priority and confirm the fix before your next sale.
Joomla USES PHP
Joomla runs on PHP. Update Joomla and extensions, then have the server moved to a fixed PHP release.
Drupal USES PHP
Drupal runs on PHP. Check the PHP version in Reports > Status report and ask your host to update.
Magento / Adobe Commerce USES PHP
Magento runs on PHP. Adobe Commerce Cloud customers should confirm with Adobe; self-hosted stores need a PHP update and an FPM restart.
GoDaddy, Bluehost, HostGator USES PHP
Shared hosting at these providers usually runs WordPress or other PHP apps. Log in to cPanel and open “Select PHP Version” or “MultiPHP Manager”, or call their support line and ask them to confirm a fixed PHP version.
WP Engine, Kinsta, SiteGround USES PHP
Managed WordPress hosts update PHP on their servers, but your site may be pinned to an older version. Check the PHP version setting in your dashboard and ask support to confirm the fix is live.
Shopify NO PHP
Shopify doesn't use PHP for your store. Shopify maintains its platform; no action is needed on your storefront.
Wix NO PHP
Wix doesn't use PHP for your site. Wix maintains its servers for you.
Squarespace NO PHP
Squarespace doesn't use PHP for your site. Nothing to update on your side.
Questions & answers
How can I tell if my website uses PHP?
Enter your website's address above: we look for signs of PHP in what your website shows publicly. Most website software you install yourself, such as WordPress, WooCommerce, Drupal, Joomla and Magento, runs on PHP. That includes most sites hosted at GoDaddy, Bluehost, HostGator, SiteGround and WP Engine. Hosted site builders like Shopify, Wix and Squarespace don't use PHP for your site. The surest answer comes from your host or developer.
Is my WordPress site affected?
Yes, if you run WordPress on your own hosting: WordPress runs on PHP, so the PHP version on your server needs to be updated. On WordPress.com, Automattic maintains the servers and PHP for you.
What should I do if my website uses PHP?
Ask your host or developer to update PHP to a fixed version today. If that isn't possible right away, have the PHP project's temporary protections applied, or take the site offline until it's fixed, as CISA advises. Then have the server checked for signs of a break-in.
Does my business have to report a breach?
Possibly. Every U.S. state has a data breach notification law, and some industries (healthcare under HIPAA, payments under PCI DSS, financial firms under the FTC Safeguards Rule) have their own rules. If you find signs of a break-in, talk to your attorney or cyber insurance carrier promptly. You can also report incidents to CISA at cisa.gov/report.
Will this affect my cyber insurance?
Many U.S. cyber insurance policies expect you to patch known critical vulnerabilities in a reasonable time. Keep your host's written confirmation that PHP was updated: it is useful documentation if you ever file a claim.
Why does the check say “No signs”?
We can only see what your website shows publicly, and many websites hide what they run on. “No signs” means we found nothing that points to PHP, not that your website is safe. Ask your host or developer to confirm.
Which PHP versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 and newer releases. PHP 8.1 and older no longer receive security fixes, so websites on those versions need to move to a supported, fixed version.
Do you store the website I check?
No. The address is used to run the check and then discarded, and the result isn't stored either. To prevent abuse we only keep short-lived, scrambled counters that can't be turned back into an address.
Free from Zensifi.AI, for every business
We built this as a public service while the web patches up. Our day job is AI-Powered Video AdTech for YouTube, Social Video and CTV, finding the waste hiding in ad budgets the same way this tool finds risk hiding on servers. Curious what we'd find in yours?
Book a DemoAdvice last reviewed October 26, 2026 against php.net, the NIST National Vulnerability Database and CISA. Not affiliated with the PHP project, NIST or CISA. Not legal advice. This check only sees what a website shows publicly and is not a guarantee of safety.