What Is PHP? The Language Behind Most of the Web, Explained
You've probably never typed a line of PHP, but you've used it thousands of times. If you've read a WordPress blog, looked something up on Wikipedia or bought something from a small online shop, there's a good chance PHP built the page you were looking at.
It made the news this week for a bad reason (more on that in Black October), so here's the plain-English version.
What PHP is
PHP is a programming language that runs on the server, the computer where a website lives, not on your phone or laptop.
Its job is to build web pages on the fly. When you visit a PHP site, the server runs the PHP code, grabs whatever it needs (your account, the latest posts, what's in your cart), assembles a finished page and sends it to your browser. Your browser never sees the PHP. It just gets the result.
A quick history:
- 1994: Rasmus Lerdorf wrote a few small tools to track visits to his online résumé. He called them "Personal Home Page Tools."
- 1995: He released the code publicly, and other people started building on it.
- 1998: PHP 3 came out, and the name became a programmer joke: it now stands for "PHP: Hypertext Preprocessor," an acronym that contains itself.
- 2015 and 2020: PHP 7 and PHP 8 made it much faster and more modern. It's still actively developed today.
Static vs. dynamic, the easy way
Think of a website like a restaurant.
- A static site is a vending machine. Everything's already made. You press the button, you get the same thing everybody else gets. Fast, cheap, very hard to break into.
- A dynamic site (like one running PHP) is a kitchen. Every order gets cooked to order. That's how you get logins, shopping carts, comment sections and an admin dashboard where you can write a new post. More powerful, but there's a kitchen, and kitchens need to be cleaned and inspected.
PHP is the cook.
Who uses it
- WordPress, which runs roughly 4 in 10 websites on the internet
- WooCommerce, the online store add-on for WordPress
- Wikipedia (its software, MediaWiki, is PHP)
- Drupal, Joomla and Magento, other popular website platforms
- Facebook started on PHP back in 2004
- Countless custom business sites, booking systems and member portals
That's why a bug in PHP itself is such a big deal. It's not one website's problem. It's the engine under a big chunk of the web.
Does my website use PHP?
| If your site is built with... | Does it run PHP? | Who has to update it? |
|---|---|---|
| WordPress (self-hosted, like on SiteGround, Bluehost or GoDaddy) | Yes | Your host updates PHP; you update WordPress, themes and plugins |
| WooCommerce, Joomla, Drupal, Magento | Yes | Same as above |
| WordPress.com | Yes | WordPress.com handles it |
| Squarespace, Wix, Shopify | Their own systems | The platform handles it |
| A static site (plain HTML on Cloudflare Pages, Netlify, GitHub Pages) | No | Nothing to patch for PHP |
Not sure? Ask whoever built the site, or log into your hosting account. Most hosts show your PHP version right in the control panel.
What to check after PHP2Shell
- Find out your PHP version. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer.
- Know that updating WordPress isn't the same as updating PHP. WordPress is the app. PHP is the engine underneath it. Your host controls the engine.
- On PHP 8.1 or older? Those versions no longer get official updates. Ask your host about moving to 8.3 or newer, and test your site afterward, because older themes and plugins sometimes break on newer PHP.
- Update WordPress, your theme and your plugins too. While you're in there, delete any you don't use.
- Put a free firewall in front of it. Cloudflare's free plan started blocking known PHP2Shell attacks within hours of the leak.
- Make sure you have a backup you could restore from if something went wrong. (Our backup guide covers your devices; your host usually has a backup tool for your site.)
Is PHP "bad"?
No. Every language has bugs, and PHP has been around long enough to have had plenty. It's maintained by a dedicated team, it got patched fast this week, and it still powers more of the web than anything else. The risk usually isn't PHP itself. It's the forgotten site nobody's updated since 2019.
Want help?
If you're not sure what your website runs on, whether it's patched or who even has the login, that's exactly the kind of thing we sort out. We'll check your site, your hosting and your plugins, update what needs updating and show you where everything lives. Book a session.