What is PHP? A plain-English primer

By Keith Motte, Topofmind.AI, former AWS Enterprise Support Manager who ran about 20 end-of-life and patch campaigns for healthcare customers. Last updated Oct 22, 2026.

Short answer: PHP is free, open-source software that runs on web servers and builds web pages. The name stands for "PHP: Hypertext Preprocessor."^[1][2] W3Techs finds it on 69.3% of websites whose server-side language it can identify.^[3]

WordPress, Drupal and Joomla run on PHP.^[5]

What PHP does on a web server

A visitor asks for a page.
PHP on the server runs the site's code, sometimes reading a database.
PHP sends finished HTML to the browser. The visitor never sees the PHP.^[1]

Why it matters for your site

If your site runs on PHP, your host or you must keep PHP updated, separately from WordPress or plugin updates. On Oct 21, 2026, PHP fixed two critical flaws called PHP2Shell. Read PHP2Shell explained or run the free check.

What to do now if your site uses PHP

Ask your host or web developer: "Does my site run on PHP, and which version?"
If yes, follow the steps in What to do now.

Frequently asked questions

What does PHP stand for?

PHP stands for PHP: Hypertext Preprocessor. It is a recursive acronym: the name contains itself.

What is PHP used for?

PHP runs on web servers and builds web pages before they reach your browser. WordPress, Drupal and Joomla run on it, according to watchTowr.

Does Squarespace use PHP?

Squarespace says it does not support server-side code, including PHP, on customer sites. We found no Squarespace statement about PHP2Shell as of Oct 22, 2026; ask Squarespace about its own servers.

What is PHP in cyber security?

PHP is the software on the server that runs a site. A flaw in PHP, such as PHP2Shell in Oct 2026, can expose every site on that server, whatever the site's own code does.