PHP
PHP is a general-purpose scripting language used for web development.
What detecting PHP tells you about a site
PHP runs the largest share of the web, almost always server-side. You catch it from `X-Powered-By: PHP/8.x` headers, a `PHPSESSID` cookie, `.php` extensions in URLs, or framework-specific markers (Laravel's `XSRF-TOKEN` cookie, WordPress's `/wp-content/` paths). Detecting PHP usually means a CMS or a mature server-rendered application rather than a JavaScript SPA — and the exact framework underneath (WordPress, Laravel, Symfony, Drupal) tells you far more about the architecture than the language alone.
The detail that matters for PHP
When a `Server`/`X-Powered-By` header leaks the PHP minor version, it is a direct read on patch hygiene: a site still on PHP 7.x is past end-of-life and missing years of security fixes, whereas 8.1+ is current.
PHP in a real-world stack
When you find PHP, it rarely travels alone. WordPress, Laravel, Symfony or Drupal almost always sit on top; MySQL/MariaDB behind; and an Nginx or Apache front door.
About
PHP is a general-purpose scripting language used for web development.
Categories: Programming languages
Quick facts
Detection methodology for Programming languages
Programming languages reveal themselves through extension fingerprints (`.php` URLs for PHP, `.aspx` for ASP.NET), framework-specific patterns and (for client-side runtime languages like TypeScript and Sass) the `node_modules/<lang>/package.json` entry inside the sourcemap. Bun, Node.js and Deno on the server side identify themselves via response headers when emitted (`X-Powered-By: Bun`, `X-Bun-Version`).
How we detect PHP
Sourcemap Explorer carries 6 fingerprint signals for PHP, spread across 5 channels — response header, cookie, script src url, url pattern and dom selector. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Server-side fingerprint: the response header reveals the technology behind the page. Visible in DevTools → Network → response headers.
Server: php/?([\d.]+)?
X-Powered-By: ^php/?([\d.]+)?
Cookies set by the platform. Visible in DevTools → Application → Cookies.
PHPSESSID
Script URL pattern. Typically a CDN host or chunk path that ships with the technology.
\.php(?:\?|$)
The page URL itself follows a known pattern (vanity slugs, embeds, hosting URLs).
\.php(?:$|\?)
A DOM selector that only this technology's pages render. Verified at runtime by the content script.
form[action*='login_process.php'], form[action*='assets/mail.php']
FAQ
How do I check if a website is using PHP?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. PHP's specific fingerprints here are response header, cookie, script src url, url pattern and dom selector, and the popup flags PHP whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What PHP version can Sourcemap Explorer detect?
PHP ships as a hosted programming languages rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
Where can I read more about PHP?
Official site: https://php.net. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Keep reading on Sourcemap Explorer
Practical guides
Alternative tools
Detected by Sourcemap Explorer
Open the popup on any page running PHPand you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.