Fix guide · Exposure · high

PHP version disclosed or end of life

Your server announces its PHP version in the X-Powered-By header. Attackers and bots read it to pick exploits: an end-of-life branch gets no security fixes at all, and a version behind on patches may be open to known bugs such as PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

Time to fix

5 minutes to hide · upgrade varies

Risk if ignored

Targeted, automated exploitation

Breaks anything?

Hiding the version: no. Upgrading: test first

How to fix it

In php.ini (find it with: php --ini):

expose_php = Off

Then restart PHP-FPM or Apache. This only hides the version; it does not patch anything.

Install a supported, patched PHP (Ondřej Surý's packages):

sudo add-apt-repository ppa:ondrej/php
sudo apt update
sudo apt install php8.4-fpm php8.4-mysql php8.4-curl php8.4-mbstring php8.4-xml

Switch your site to the new PHP-FPM socket, test, then remove the old version.

Most hosts have a "PHP version" selector in the control panel:

Choose the newest supported version, then add to .htaccess:\nHeader unset X-Powered-By

If your host still only offers end-of-life PHP, it is time to move.

Patched versions for PHP2Shell: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older than 8.2 gets no fixes at all.

Check your fix

Common mistakes

Hiding the header and calling it fixed. The server is just as vulnerable, only quieter.
Upgrading PHP without testing plugins and themes first.
Forgetting the CLI and cron PHP, which can be a different version from the web one.