Your site reports PHP and WordPress versions that include the security fixes. This is based on version numbers only, so it's still worth confirming with your hosting provider.
Free tool for online stores
Is your store affected by the October PHP and WordPress security vulnerabilities?
Enter your website address. We'll read the PHP and WordPress versions your site shares publicly and tell you whether they include the latest security fixes.
We only read what your server already shares with every visitor. We don't scan, log in to or test your site.
01. Results
What your result meansThree possible outcomes
Your site reports a PHP or WordPress version from before the fix. Update WordPress from your dashboard, and ask your hosting provider to update PHP or confirm in writing that the fix has been applied.
Your site doesn't share its PHP or WordPress version, which is common and good practice. It doesn't mean your site is safe or unsafe. Check your versions in WordPress instead.
02. Unknown result
Check your versions in WordPressTakes about a minute
Many stores get an Unknown result because their site keeps its versions private. Here's how to find them yourself.
WordPress version
- Log in to WordPress. Go to
yourstore.co.za/wp-admin. - Open Updates. In the left menu, go to Dashboard, then Updates. It shows "You have the latest version of WordPress" or the version you're on, for example
7.1.3.
PHP version
- Log in to WordPress. Go to
yourstore.co.za/wp-admin. - Open Site Health. In the left menu, go to Tools, then Site Health.
- Open the Info tab at the top of the page.
- Expand the Server section.
- Find "PHP version". It shows three numbers, for example
8.3.35.
Using WooCommerce? You can also go to WooCommerce, then Status, and look under Server environment.
Your hosting panel may only show something like "8.3". That's the version family, not the full version, so it can't tell you whether the fix is included.
Patched WordPress versions
| Version family | Fixed in |
|---|
WordPress released fixes for every version family back to 4.7. Versions 4.6 and older have no fix, so update to a current release.
Patched PHP versions
| Version family | Fixed in |
|---|
PHP 8.0 and older no longer get official security updates. If you're on one of these, speak to your hosting provider about upgrading.
03. FAQs
QuestionsAbout this check
Does this tool scan or test my site?
No. It makes a few ordinary requests, the same as a browser opening your homepage and RSS feed, and reads the version numbers your site already shows every visitor. It doesn't log in, look beyond those public pages or try any kind of attack.
Is an "Up to date" result a guarantee?
No. The check compares version numbers only. They can be changed or out of date, so confirm with your hosting provider if you need certainty.
My result says "Needs update" but my host says I'm patched.
Some hosting providers apply security fixes without changing the version number. If yours has, ask them to confirm it in writing.
Do I need to be a Stitch merchant to use this?
No. Anyone can use it.
I'm a Stitch merchant. What should I send you?
A screenshot from WordPress Site Health showing your full PHP and WordPress versions, or written confirmation from your hosting provider that the fixes have been applied. Reply to our email or contact Stitch support.