What is the PHP probe file for?

The UpdatePHP probe file is a small PHP script you place on a website so UpdatePHP can read the real PHP version that server is running. It is used by the My Sites portfolio when response headers do not expose PHP, or when you want a reliable version check instead of guessing from headers alone.

Why a probe file is needed

Many hosts hide the PHP version in HTTP response headers. Remote scanners then cannot tell which release a site is on. The probe file runs on the server itself and returns the version from PHP's own constants, so the reading matches what that site actually uses.

What the file does

After you download the probe from your UpdatePHP account and upload it, UpdatePHP can request it using a per-site secret and short-lived HMAC signatures (no long-lived key in the URL). With a valid signed request the file can:

• Return the probe file format version
• Return the server PHP version (major.minor.patch)
• Return any optional extras selected at download time (runtime details or PHP framework/CMS versions)

The download is built dynamically: only the checks you select are included in that site's probe file. Without a valid signature the script exits and returns nothing useful. It does not list arbitrary files, run database queries, or dump phpinfo.

PHP compatibility

The probe is written for the widest practical range: it runs on PHP 5.6.0 through current PHP releases. If the file fails to run, is blocked by a host or ISP, or shows a PHP compatibility issue, please contattaci so it can be investigated.

How to install it

1. In My Sites, open the download probe action for the site (sites set to use a probe file).
2. Choose a probe profile (a named set of optional runtime or framework checks), then download.
3. Save the downloaded .php file without editing it. The filename includes a random token (for example updatephp-probe-a3f9c2b1e04d.php) so it is not a predictable fixed name.
4. Upload it to the same public folder as the Website URL in My Sites. For a site at the domain root that is usually the document root (often where index.php or index.html lives). If the site is installed in a subfolder (for example https://example.com/shop), upload the probe into that /shop folder — not the domain document root.
5. Use FTP, SFTP/SSH, or the host control panel file manager — whichever you normally use to put files on that site.
6. Leave the file in place so scheduled rescans can keep reading the version and selected extras. Framework and CMS checks look next to the probe file (and a couple of parent folders), so the probe should sit with that site's application files.

The file must start with <?php on line 1. Do not add a BOM, blank lines, or HTML above that tag, and do not rename or edit the script body. If you change the selected options, download again and replace the file on the server.

Security notes

• Each site has its own probe secret and a random filename. Do not share the file or publish it in a public repository.
• Requests are signed with HMAC; the secret is not sent as a query-string key on new probe files.
• Anyone without the secret cannot use the probe to read the version or selected extras.
• The probe only answers the narrow requests UpdatePHP makes for that download; it is not a general remote shell or phpinfo dump.
• If a probe may have been exposed, use Rotate key in My Sites, download the new file (same filename), and replace the old one on the server.

After upload

Run a rescan on that site from My Sites. If the probe is reachable at the Website URL path and the signature matches, UpdatePHP stores the reported PHP version (encrypted at rest) and uses it for risk and end-of-life status like any other tracked site. Selected extras are stored with the scan result.

If the scan cannot reach the probe, confirm the file is in the public folder that matches the Website URL (including any subfolder path), the filename was not changed, and that URL matches the live site location. After rotating a key, the old file will stop working until the new download is uploaded.

Related guides

• How to check what version of PHP I am running
• What are the latest safe versions of PHP I can use?
• When do updates for my website's version of PHP end?