PHP: Server language detection

Understand PHP’s role in server-side web development, how it generates responses, and how the language differs from the CMS or framework built with it.

Updated 8 September 2026

What PHP does on a website

PHP is an open-source scripting language widely used for server-side web development. The server executes PHP code and sends the resulting response to the browser. Visitors normally receive the generated output, not the original PHP source.

A page can therefore show content from a database or process a submitted form before sending HTML. The visible page does not reveal every operation the server performed to create it.

Language, framework and CMS

PHP is a language, while systems such as WordPress and Laravel provide higher-level application structures. A custom PHP application can also exist without either of them. These layers should be described independently.

For example, knowing that a site uses PHP does not establish whether editors use WordPress, whether it has a custom admin panel or which company provides its hosting.

Maintaining a PHP application

Track compatibility between the PHP runtime, application code and installed extensions. A runtime upgrade should be tested with real workflows, especially where older libraries or custom code are involved.

Keep private source and configuration out of publicly served locations. Also measure application and database work when investigating slow requests: a language name alone does not explain the performance of an individual website.

How DNSTrace.dev detects PHP

Detection reads the final HTTPS response and the first bytes of its markup. One matching signal is reported as strong evidence; two or more independent signals are reported as confirmed.

PHPSESSID cookie — The default PHP session cookie name, set when a session starts.
x-powered-by naming PHP — The interpreter banner, which includes the version unless it is disabled.
server naming php-fpm or a PHP handler — Supporting evidence from the process serving the request.

What a detection proves

The response was produced by a PHP runtime.

What it does not prove

Which application or framework runs on it, or that the reported version is current. Frameworks such as Laravel replace the default session cookie, so PHP can be present without PHPSESSID appearing.

Common questions about PHP

Does PHP run in the visitor’s browser?

In a conventional PHP website, PHP runs on the server and generates the response. Browser JavaScript is a separate layer that can add interactivity after the page arrives.

Why does a WordPress site not always report PHP?

WordPress does not start a PHP session for anonymous visitors, so no PHPSESSID cookie is set. The application is still PHP; the runtime simply left no public signal.

Does x-powered-by expose the PHP version?

It does by default. Disabling expose_php removes it, which is common hardening practice.

Content management system