Outdated CMS check: what CMS and WordPress version a site uses

An outdated CMS is a content management system such as WordPress, Drupal or Joomla whose version no longer receives security fixes, so every newly discovered flaw stays open. The same applies to PHP on the server and to libraries such as jQuery. For free and without sign-up, the WebMeter CMS checker estimates from public traces what CMS your site is using and whether any part of it is past its end of support.

Updated 28 Oct 2026

What a CMS is and what end of support means

A CMS (content management system) is the software you manage the website in: WordPress, Drupal, Joomla or hosted platforms such as Shopify, Wix or Shoptet, a popular Czech e-shop platform. Underneath it run PHP and an Apache or nginx web server, and in the visitor’s browser JavaScript libraries such as jQuery or Bootstrap.
End of support (end of life, EOL) is the date after which the authors stop releasing security fixes for a version. The software keeps working, but nobody fixes it any more.

End of support for the most common software, as of October 2026:

End of support by software
Software	Status	Security fixes
PHP 8.1 and older	unsupported	ended (8.1: 31 Dec 2025)
PHP 8.2	support ending	until 31 Dec 2026
PHP 8.3, 8.4 and 8.5	supported	until 31 Dec 2027, 2028 and 2029
WordPress	latest version supported	WordPress.org also ships them for older branches from 4.7, but they protect only where installed
Drupal 7	unsupported	ended 5 Jan 2025
Drupal 10	support ending	until 9 Dec 2026
Joomla 3 and 4	unsupported	ended 17 Aug 2023 and 14 Oct 2025
Joomla 5	security fixes only	until 12 Oct 2027
jQuery 1.x and 2.x	unsupported	versions before 3.5.0 have public flaws, one listed by CISA as exploited
AngularJS	unsupported	ended 31 Dec 2021
Windows Server 2012 and 2012 R2 (IIS)	unsupported	paid extended updates ended 13 Oct 2026

Sources: php.net, WordPress.org, drupal.org, joomla.org, Microsoft Lifecycle, AngularJS and the CISA KEV catalogue.

Why an outdated CMS hurts a small business

Attacks on small websites are rarely targeted. Bots crawl the internet looking for known software versions with publicly documented flaws and misuse them automatically. A compromised website may then send spam, redirect visitors to fraudulent pages or leak data from forms and orders. Browsers and search engines may flag it as dangerous, which hurts both customer trust and traffic. An outdated system often shows up only when the hosting provider drops an old PHP version and the website stops working on the new one. Anyone vetting suppliers can also see it from the outside, for example under the NIS2 cybersecurity rules.

Common problems with an outdated CMS

WordPress hasn’t been updated for years because it would break a theme or plugin that nobody maintains any more.
The website stayed on an old PHP version because nobody planned the move to a new one.
A theme or plugin ships its own old copy of jQuery or Bootstrap, which core updates don’t touch.
The Server and X-Powered-By headers reveal the exact PHP or server version, making it easy to look up which known flaws apply (more on security headers and in the website exposure check).
A website on Drupal 7 or Joomla 3 or 4 keeps running without support because moving to a new version means an almost new website.

What CMS is this site using: what we check

WebMeter reads only the homepage: its HTML, response headers and cookies, and, if another check rendered it in the same scan, the page after JavaScript has run. It recognises the CMS and platform by specific markers (meta generator, headers, cookies, paths such as /wp-content/ on your own domain, platform addresses such as Shoptet, Wix, Webnode or Shopify). On WordPress it also recognises common add-ons such as WooCommerce, Elementor or Yoast SEO.

It compares the WordPress version with the version status published by WordPress.org and with the CISA KEV catalogue of actively exploited flaws. For Drupal and Joomla it assesses the major version, for PHP, Apache, the TLS library (the certificate itself is covered by the SSL certificate check) and nginx the version from the Server and X-Powered-By headers, and for an IIS server the corresponding Windows Server. It also flags support ending within 90 days. From script addresses it recognises jQuery, jQuery UI, jQuery Migrate, Bootstrap, AngularJS, Moment.js and Lodash. It keeps its end-of-support and library tables locally, and the operator updates them regularly.

The number in a header may not match reality because Linux distributions backport fixes into older versions; that’s why WebMeter says “probably”. It doesn’t try any attacks or hidden addresses, doesn’t log in to the admin area, and can’t verify plugin versions or whether the website has already been compromised.

CMS and technology check for free

Enter a domain and see what your website runs on and whether any part is past its end of support, together with the other areas.

Measure website →

Not sure what to make of the result? We offer a no-obligation consultation — just write to kontakt@webmeter.eu.

WordPress and PHP updates: what they involve

The PHP version is set by the hosting provider or server administrator, and only PHP 8.3 and newer receive fixes beyond 2026. Administrators run larger updates after a backup and on a copy of the site first, as an old plugin or theme may break. A new WebMeter scan then shows whether anything was left behind.

Website design instead of patching an old WordPress

When a website is held together by a theme or plugin that nobody maintains, updates keep getting postponed and the site keeps ageing. We build a new website from scratch on supported software, without old copies of libraries such as jQuery. After handover you manage the content without a developer.

How website design works → Case study: from 73 to 97 points →

FAQ on CMS and outdated software

Why doesn’t WebMeter show a version for my website?

It can only read what the website publishes itself: the generator meta tag, the addresses of core files or the server headers. If the website hides the version, WebMeter doesn’t guess it. A hidden version doesn’t mean current software, though; the actual state is known to your web administrator or hosting provider.

Is hiding the version enough instead of updating?

No. A hidden version only makes it harder to look up which flaws apply. Bots often try known flaws blindly, whatever the version. What protects you is software that receives security fixes and has them installed.

What does it mean that PHP is past its end of support?

The PHP authors have stopped releasing security fixes for that version. According to php.net, as of October 2026 all versions up to and including 8.1 are unsupported and PHP 8.2 receives fixes until 31 December 2026; after that, only PHP 8.3 and newer get them. Linux distributions sometimes backport fixes into older versions themselves, so WebMeter marks such a finding as probable.

How do I find out what CMS a website is using?

Enter the address into WebMeter. From markers in the HTML, headers and cookies it recognises WordPress, Drupal, Joomla and hosted platforms such as Shopify, Wix, Webnode or Shoptet. On WordPress it also recognises common add-ons such as WooCommerce, Elementor or Yoast SEO.

How often should WordPress be updated?

Continuously, because only the latest version is supported. By default WordPress installs core security releases on its own; plugins and the theme update automatically only where that is switched on. The PHP version also needs watching, as the hosting provider will retire it in time.

Other areas checked

How the check treats your website is described on the page about the WebMeterBot robot; what is stored and for how long is in the data processing policy.