The screen is fine, but the version is frozen.
Because the website opens the same as yesterday, what is frozen inside the server is not visible from the outside. That's the PHP version. Even if the version is old, the screen does not slow down and errors do not occur, so it is quietly removed from the check list while the person in charge is changing.
So, rather than citing someone else’s research, I counted it myself. BlueCanvas review archiveIt sequentially connects to the 641 destinations where the target site address remains, and uses the response header sent by the server itself. X-Powered-By and Server I only read it. No attempt was made to probe for vulnerabilities, and all I received was a first screen. 615 places responded.
Of the 26 places that revealed the version, 22 have ended support.
Where the PHP version is written in the response header, 26 placesIt was. Among them, only four versions still had security support, and the remaining 22 versions had already reached the end of support.
| version | place | Security support end date | lapse |
|---|---|---|---|
| 7.4 | 6 places | 2022-11-28 | 3 years 9 months |
| 7.3 | 5 places | 2021-12-06 | 4 years 8 months |
| 5.4 | 4 places | 2015-09-03 | 10 years 11 months |
| 5.2 | 2 places | 2011-01-06 | 15 years 7 months |
| 8.3 · 8.4 | 4 places | 2027-12-31 · 2028-12-31 | Within the support period |
If you add one place of 5.3, one place of 7.1, two places of 7.2, and one place of 8.1 that are not listed in the table, there are 26 places. Among the 22 places where support was completed 21 placeshas been over 3 years since its end date, the oldest being 5.2.17 which ended in 2011.
End of support means no fix.
The end of security support does not mean that performance will be slightly reduced. Even if new vulnerabilities are discovered There are no more fixes for that version.means. It says so in PHP's official support policy.
From the attacker's perspective, the version number is like a list of what vulnerabilities remain. No matter how much you create a new screen, the conditions will not change as long as the version running underneath it remains the same.
There were more than five times as many places with hidden versions.
One more thing was confirmed in this measurement. Based on the cookie, final address, and response header, it is confirmed that it is running in PHP. 157 placesHowever, there were only 26 places where the version was read. remain 131 placesThe setting to not export version numbers (expose_php = Off) was.
It's better to leave this setting on, as it will automatically keep you out of the list of things you're skimming through. but Hiding it and posting it are different things. Even if you mask the number, any remaining vulnerabilities on the server remain. So the numbers in this section do not say “what percentage is dangerous” but only “how many places have exposed versions and how many of them have ended support.”
You can check it in 30 seconds
- in your browser F12 to open developer tools.
- network tab, refresh it, and then select Document Requests at the top.
- right response headerat
x-powered-by: PHP/7.4.33Find the line written like this. - If that line isn't there, connect to the server.
php -vConfirm in one line:
If you checked the version PHP official supported version tableYou can compare it with . If the version has already passed its end date, you will need to schedule an upload.
You must follow the order when posting.
- Write down the version now. response header or
php -vRecord the confirmed value as is. - Check compatibility first. Match the versions required by CMS, plugins, and libraries.
- Try uploading from a duplicate first. Make a copy of the same configuration, upload it, and fix the error.
- Then upload the real server, The setting to hide the version is turned on last.
If you skip the third step and upload the actual server first, there will be no room left to revert. As the version jumps larger, older functions may disappear and the screen may freeze, so the time it takes to pass one clone is ultimately the shortest.
It's rare that the PHP version alone is the problem. How to check if your website has been hacked in 10 secondsclass Certificate checkYou can get a general idea of the server status by checking .
Measurements were taken on August 30, 2026. All domains on the screen and in the text must be used to avoid pointing to a specific company. example.com I changed it to , and only the header value was written as it came out of the measurement.
