What is PHP? A plain-English guide for everyone else

Since PHP’s emergency security release yesterday, a lot of people have been asking the same question: what actually is PHP, and should I care?

It’s a fair question. You have almost certainly used PHP several times today without knowing it. I’ve been building websites and systems with it for well over a decade, so here’s the explanation I give friends and family, plus a few stories from the work it’s been part of.

The short answer

PHP is a programming language: a set of instructions that tells a computer what to do. Its particular job is building web pages at the moment you ask for them.

It runs on the server, the computer somewhere in a data centre that “hosts” a website, not on your phone or laptop. You never see PHP itself. You only see what it produces.

Think of a website as a restaurant.

The part you see, with the layout, colours, buttons and pictures, is the dining room. That’s handled by other technologies your browser understands.

PHP is the kitchen. When you click “add to basket”, log in, or search for a product, you’re placing an order. PHP takes that order, checks the stock (the website’s database), prepares a page made specifically for you, and sends it out to your table.

That’s why your basket shows your items and your account page shows your name. Someone else visiting the same site at the same moment gets a different plate from the same kitchen.

Some websites are more like a printed menu: the same page for everyone, never changing. Those don’t need a kitchen. But the moment a site has logins, forms, shopping or anything personal, something has to do the cooking, and very often that something is PHP.

You’ve met it more than you think

WordPress, the system behind around four in ten of all websites, is written in PHP. If you’ve read a blog, a local news site or a small business’s homepage recently, there’s a good chance it was WordPress.
Wikipedia runs on software written in PHP.
Facebook was originally built in PHP, and still runs on a language descended from it.
A huge number of online shops, booking systems and membership sites run on it too.

According to W3Techs, which tracks this kind of thing, PHP powers roughly 70% of websites where the server-side language can be identified. Nothing else comes close.

Where it came from

PHP started in 1994 as a handful of tools a programmer called Rasmus Lerdorf wrote to run his own homepage. The name originally stood for “Personal Home Page”. It grew from there, and it’s now maintained by a community of volunteers and companies, and free for anyone to use.

That last part matters. The software running a big chunk of the internet isn’t owned by one company. It’s looked after by people all over the world, many of them in their spare time.

I’ve been a small part of that. Between 2018 and 2020 I had fixes accepted into several of the open-source building blocks that PHP developers rely on, including Laravel and Symfony (two of the most popular toolkits for building PHP applications) and Guzzle, which handles a lot of the behind-the-scenes conversations between websites. One of my fixes was for a bug that only appeared when a particular security setting was configured in an unusual way. Nobody would ever write a headline about it, but somewhere a website stopped breaking because of it. That’s what most of open-source work looks like.

What it’s actually like: a few stories

The websites small businesses depend on

Earlier in my career, working at a digital agency, I built websites for local businesses: online shops, sites designed to bring in enquiries, and plenty of WordPress builds.

None of those clients ever asked me what language I was using, and they were right not to. What they cared about was whether the enquiry form actually reached their inbox, whether customers could pay, and whether the site was still working on a Saturday night. PHP was the kitchen; they just wanted the food to come out.

It’s also why so many small businesses are on PHP without knowing it. If you had a website built in the last fifteen years, there’s a decent chance this is you.

Defending the checkout

A few years ago, as technical lead at an online retailer, I spent months dealing with a sustained fraud campaign. Someone was repeatedly pushing fraudulent orders through the checkout, changing tactics every time we blocked them.

The checkout ran on PHP, and that’s where the fight happened. Every order had to pass through the kitchen, so that’s where we added the checks: limiting how fast anyone could place orders, making sure each order really came from a genuine visit to the site, and re-checking the basket and prices on the server rather than trusting what the visitor’s browser claimed. We added protection in front of the site too, and kept adapting as the attacker changed approach.

Fraudulent orders dropped by roughly 99.9%, and I ended up walking Cheshire Police and PayPal UK through what we’d found. The lesson for non-developers: the bit of a website you can’t see is where your customers are actually protected.

Servicing the engine

At Crowdcube, the investment crowdfunding platform, I led an upgrade of several of our production systems from PHP 7.2 to PHP 8.0.

From the outside, nothing changed. Investors saw the same pages. But older versions of PHP stop receiving security fixes after a few years, just like an old phone stops getting updates. Upgrading is the website equivalent of a car’s service and MOT: unglamorous, easy to put off, and the thing that keeps you safe on the road.

Keep that one in mind. It comes back in a minute.

Still building with it today

Right now I’m building a property management platform in modern PHP. It handles tenancies, deposits, rent arrears and compliance, where the rules come from UK law and getting one wrong is a legal problem, not just a bug.

I mention it because you’ll sometimes hear that PHP is old-fashioned or “dead”. It’s neither. PHP has been around for thirty years, and it’s changed enormously in that time. Age isn’t a weakness here: plenty of the most reliable things around us are old designs that have been refined for decades.

So why is PHP in the news?

On 21 October 2026, PHP announced two critical security flaws, nicknamed PHP2Shell. In restaurant terms, the problem isn’t a dodgy recipe on one website’s menu. It’s a fault in how the kitchen receives orders, before the chef even reads them. A carefully crafted “order” can let an outsider take control of the kitchen.

Because the flaw is in PHP itself, it can affect any website that runs on it, whatever the site does. Attacks were reported on the same day the fix came out. I’ve written a fuller plain-English explanation of PHP2Shell if you want the details.

The fix is to update PHP. And this is where the servicing story matters: W3Techs’ figures suggest more than a third of PHP websites are still on versions 7 or older, which no longer receive official security fixes at all. Those sites don’t just need a quick update; they need the bigger job that was put off.

What should you do?

You don’t need to learn PHP. But if you own or run a website, it’s worth knowing three things:

Is my website built on PHP? If it’s WordPress, yes. Otherwise, ask whoever built it.
Which version of PHP is it running, and has it been updated this week? If you’re on WordPress, I’ve written a two-minute check you can do from your dashboard.
Whose job is it to keep it updated? Your hosting company, your developer, an agency, or you? Many people find out the answer is “nobody” only after something goes wrong.

If those questions don’t have clear answers, now is a good time to find them.

PHP is one of the quiet workhorses of the internet: a kitchen most people never see, cooking most of the pages they use. It mostly gets talked about when something goes wrong. This week something has, so it’s worth five minutes to make sure your kitchen’s been looked after.

Have a question I haven’t answered? Get in touch.