You can use the find command to list all .php files under /var/www/vhosts/ that have been modified in the last 30 days. Here’s how you can do it:

find /var/www/vhosts/ -name "*.php" -mtime -30

This command will search the /var/www/vhosts/ directory and its subdirectories for .php files (-name "*.php") that have been modified in the last 30 days (-mtime -30). If it finds a match, it will print the filename to the terminal.

Please note that you might need to use sudo before the find command if the files require root permissions to read.