Skip to main content

Is your WordPress up to date?

Enter your website address and we'll tell you what can be seen from outside: the WordPress version, the PHP version and the plugins that show theirs, compared with the latest releases. No sign-up, in a few seconds.

We only read what any visitor sees on your home page: we don't try passwords or look for hidden files. We keep the address and the result for 24 hours, only to avoid repeating the check. Privacy policy.

How WordPress sites are doing today

Public data from WordPress.org and php.net, updated every time we publish the website. You can cite it by linking to this page.

  • 33.1% of WordPress sites run a PHP version that no longer gets security fixes (older than 8.2).
  • 55.9% will on 1 January 2027, when PHP 8.2 loses security support. 22.9% of sites run that version today.
  • 64.8% run the latest major WordPress version (7.1). 28.2% are still on a version older than 7.0.

On 21 October 2026, PHP fixed two critical flaws that let anyone run code on the server without a password, and on 26 October CISA added them to its catalogue of vulnerabilities being exploited. Versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and later releases in each branch, include the fix. For unsupported branches PHP hasn't released new versions: only a patch that some providers apply without changing the number. Sources: PHP announcement, CVE-2026-109618, CVE-2026-109619, CISA catalogue.

PHP version of WordPress sites · % of installs
  • 8.5 6.0% (Active support)
  • 8.4 10.4% (Active support)
  • 8.3 27.6% (Security fixes only)
  • 8.2 22.9% (Security fixes only)
  • 8.1 9.4% (Unsupported)
  • 8.0 3.4% (Unsupported)
  • 7.4 14.8% (Unsupported)
  • ≤ 7.3 5.4% (Unsupported)

Sources: WordPress.org PHP statistics, WordPress.org version statistics and php.net supported versions. Retrieved on 31 October 2026.

Download the data (CSV) CC BY 4.0 · CC BY 4.0 licence: you can reuse it by citing this page.

How we check

What we look at

  • Only the home page, as any visitor would see it.
  • The WordPress version, from the tags it publishes and the core files it loads.
  • The PHP version, if the server announces it in its headers.
  • The plugins and themes that show their version, compared with WordPress.org.
  • Whether the website loads over HTTPS and whether its http:// version redirects to the secure one.

What we don't do

  • We don't look for hidden paths or files, or test for security flaws.
  • We don't keep personal data: the address and the result are deleted after 24 hours.
  • It isn't a security audit: it's a first signal.