PHP

PHP is one of the most widely used languages on the web. According to W3Techs, 69.2% of all websites whose server-side programming language is known use PHP (as of October 25, 2026). Many content management systems, online shops, customer portals and frameworks such as Laravel are based on it. PHP is therefore often in use at companies, frequently without being noticed in everyday work: on the company website, in the shop or in a line-of-business application at the hosting provider.

How PHP works

When a browser requests a page, a web server such as nginx or Apache receives the HTTP request and passes it to the PHP interpreter, often via PHP-FPM. PHP executes the script, queries a database if necessary and returns the result, for example an HTML page or a JSON response for an API. Visitors do not see the source code itself.

So that PHP does not have to recompile scripts on every request, OPcache stores the precompiled bytecode in memory. Third-party libraries are usually included with Composer. PHP also runs on the command line, for example for scheduled tasks and scripts.

Supported versions

The PHP project actively supports each version for two years and then for two more years with security fixes only. According to php.net, as of October 25, 2026:

• PHP 8.5: released on November 20, 2025, active support until December 31, 2027, security updates until December 31, 2029.
• PHP 8.4: active support until December 31, 2026, security updates until December 31, 2028.
• PHP 8.3: security updates only, until December 31, 2027.
• PHP 8.2: security updates only, until December 31, 2026.

PHP 8.1 reached the end of support on December 31, 2025. The entry PHP end of life explains what this means and how to upgrade successfully. According to W3Techs, 65.5% of PHP websites run version 8 and 26.8% still run version 7, whose support ended long ago.

Typical use cases

• Websites and content management systems
• Online shops and booking systems
• Customer portals and internal tools
• APIs for apps and integrations
• Background tasks such as imports, reports and data synchronization

Security and operations

• Use a supported version: Only supported versions receive security fixes. Updates within a version belong in patch management.
• Do not reveal the version: With expose_php = Off and the X-Powered-By header removed, the server does not disclose its PHP version. The security header check in the TOMORIS Toolbox shows whether your website delivers such information.
• Do not display errors: According to the PHP manual, display_errors is a development feature and should never be active on production systems. Errors belong in the log.
• Harden session cookies: Without configuration, PHP sets neither Secure nor HttpOnly for the session cookie. The options session.cookie_secure and session.cookie_httponly should be set to 1. The cookie check checks this from the outside.
• Prevent SQL injection: Build database queries with prepared statements and parameters instead of inserting input into SQL text.
• Check dependencies: Use composer audit to find known vulnerabilities in libraries.
• Limit rights: Run PHP processes under a dedicated user with minimal rights, see least privilege.

How it differs

JavaScript runs mainly in the browser, PHP on the server. The two often work together in web applications. PHP is the language, frameworks such as Laravel build on it to provide structure and ready-made building blocks, and PHP-FPM is the runtime environment in which PHP is executed on the web server.

Frequently asked questions

Is PHP still up to date?

PHP is actively developed. Version 8.5 was released on November 20, 2025, and brought, among other things, a built-in extension for parsing URLs according to RFC 3986 and WHATWG, as well as the pipe operator |>. Together with its wide adoption, this keeps PHP a solid choice for web applications.

Which PHP version should I use?

Ideally a version with active support, currently PHP 8.4 or 8.5, provided the application, plugins and libraries support it. At a minimum, a version that still receives security updates. If a website runs on an older version, the upgrade should be planned before problems occur.

How do I find out which PHP version my website uses?

In the administration area of the hosting plan, on the server with php -v or via a protected diagnostics page. Output from phpinfo() never belongs on the public web. If the X-Powered-By header shows the version, it is also visible from the outside.

Sources

• php.net: Introduction, What is PHP?
• php.net: Supported Versions (accessed October 25, 2026)
• php.net: PHP 8.5 Release Announcement
• php.net: Unsupported Branches
• php.net: Runtime configuration, display_errors
• php.net: Session runtime configuration
• php.net: Prepared statements and stored procedures
• W3Techs: Usage statistics of PHP for websites (October 25, 2026)