Does my website use PHP? How to tell what your site is built with

PHP is the most common server-side language on the web: W3Techs measured it on 69.3% of websites whose server-side language it could identify, as of October 22, 2026. That's why PHP2Shell, the pair of critical flaws PHP fixed on October 21, 2026, reaches so many businesses. But plenty of sites don't run PHP at all. The first question is which kind yours is.

Platforms that run on PHP

If your site is built on any of these, it runs PHP on a server, and someone (your host or your developer) is responsible for updating it.

Each of these has its own page with where to find the PHP version and who updates it: WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel.

Who updates PHP depends on the hosting, not the platform. On shared or managed hosting, your host installs PHP updates. On a VPS or a server you rent yourself, your developer does. On a managed WordPress host, PHP still runs; the host just handles it for you.

Platforms that don't run PHP you manage

Hosted website builders run their own servers and their own code. You can't change, patch or even see the server software, so there's no PHP for you to update.

• [Shopify](/platforms/shopify): themes are built with Liquid, a template language Shopify created, and Shopify runs the servers.
• [Webflow](/platforms/webflow): you design visually and Webflow hosts the site.
• [Squarespace](/platforms/squarespace) and [Wix](/platforms/wix): fully hosted; the platform maintains everything under your pages.

Shopify apps are a separate case. An app runs on its developer's servers, and some apps are written in PHP, but updating those servers is the app developer's job, not yours. If a developer has offered you "Shopify PHP" work, it's usually for an app or a custom back end, not your theme.

Modern JavaScript sites: Next.js, Gatsby and similar

Next.js describes itself as a React framework, and Gatsby also builds sites with React. Sites built this way run on JavaScript (Node.js) or are published as ready-made files, not PHP. Many are hosted on platforms such as Vercel or Netlify.

Watch for mixed setups. A common pattern is a Next.js or Gatsby front end that pulls its content from WordPress behind the scenes, often called headless WordPress. The pages your visitors see don't run PHP, but the WordPress install that feeds them does, usually on another address, and it still needs PHP updates.

How to tell what your website is built with

Use these 4 checks, quickest first.

1. 1Ask whoever built or hosts it. Your developer, agency or host can answer in 1 line, and they're usually the people who update PHP anyway.
2. 2Try the admin address. Add /wp-admin to your domain, as in example.com/wp-admin. A WordPress login page means WordPress. Drupal sites usually answer at /user/login and Joomla at /administrator.
3. 3Look at the page source. In your browser, view the page source and search for wp-content (WordPress), cdn.shopify.com (Shopify) or webflow (Webflow).
4. 4Run PHP Scanner. It loads your page once and reports the platform it detects, whether the site runs PHP, and the PHP version when the server shares it.

Check every address, not only the main site

Many businesses run more than 1 platform. The main site might be on Webflow or Shopify while something else runs WordPress or Laravel on another address. PHP2Shell applies to each PHP install separately, so check each address you own. Common places PHP hides:

• A blog on a subdomain such as blog.example.com, or on a separate WordPress install under /blog.
• A booking tool, client portal or quote calculator your developer built in Laravel or plain PHP.
• An old campaign microsite or landing page that's still live.
• A staging or test copy of your site left online.

If your site does run PHP

Find 3 things: which PHP version it runs, whether that's a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12), and who updates it. Is my website affected by PHP2Shell? walks through all 3, How to check your PHP version covers the version itself, and WordPress owners can go straight to How to update PHP in WordPress.