How PHP Updates Affect Your WordPress Website
PHP is the programming language WordPress runs on. The PHP version on your hosting decides three things: whether your site still gets security fixes, whether your plugins keep updating, and whether you can move to WordPress 7.
As of October 2026, your WordPress site should run PHP 8.3 or newer. PHP 8.2 stops getting security fixes on 31 December 2026. Everything older already has.
What PHP does on a WordPress website
Every time someone opens a page on your site, the server runs PHP. It loads WordPress core, your theme and every active plugin, pulls content from the database, and builds the page your visitor sees.
PHP is installed by your hosting company, not by WordPress. Updating WordPress, your theme or your plugins does not change your PHP version. Many business sites in Malaysia were set up years ago on shared hosting, and nobody has touched the PHP version since.
Which PHP versions are still supported
Each PHP version gets about four years of support: two years of active fixes, then two years of security fixes only. After that it is end of life. Here is where each version stands, based on the official PHP supported versions page.
| PHP version | Security fixes until | Status in October 2026 |
|---|---|---|
| 8.5 | 31 December 2029 | Active support |
| 8.4 | 31 December 2028 | Active support |
| 8.3 | 31 December 2027 | Security fixes only |
| 8.2 | 31 December 2026 | Security fixes only, ends in about 2 months |
| 8.1 | Ended 31 December 2025 | End of life |
| 8.0 | Ended 26 November 2023 | End of life |
| 7.4 | Ended 28 November 2022 | End of life |
A lot of WordPress sites are behind. In January 2026, WordPress.org’s own numbers showed about 22% of WordPress sites on PHP 7.4 and 15% on PHP 8.1. Add up every version past end of life and it comes to nearly half of all WordPress sites. Another 27% were on PHP 8.2, which runs out this December.
How an old PHP version affects your WordPress site
1. No more security fixes
Once a PHP version reaches end of life, new security holes in PHP itself stay open. Updating WordPress and your plugins cannot patch them. Your site is only as safe as the weakest layer it runs on, and an unsupported PHP version is a weak layer. It sits next to the other basics in our guide on securing WordPress against hacking.
2. You get stuck on an old WordPress version
WordPress 7.0 came out on 20 May 2026 and needs at least PHP 7.4. Sites on PHP 7.2 or 7.3 are not offered WordPress 7 at all. They stay on the 6.9 branch, and WordPress only officially supports its latest branch with security updates.
PHP 7.4 is the minimum today, but it has been end of life since 2022. WordPress usually drops an old PHP version once fewer than about 5% of sites use it. PHP 7.4 is still on around 22% of sites, so it stays for now. It will be cut once that number falls.
3. Plugins stop updating or break
Plugin developers set a minimum PHP version for each release. When your server is too old, WordPress will not install the new version and tells you the plugin needs a newer PHP. You keep running the old plugin, with whatever bugs and security issues it had.
4. Speed: a small gain, not a big one
The big speed jump happened years ago, moving from PHP 5.6 to PHP 7. In an older Cloudways test, response time dropped from 475 ms on PHP 5.6 to 206 ms on PHP 7.4, and 164 ms on PHP 8.0.
Between modern versions, the difference is small. A November 2025 Tideways benchmark on WordPress 6.8 found PHP 7.4 handled about 5% fewer requests than PHP 8.3, 8.4 and 8.5, which performed about the same.
So upgrade PHP for security and compatibility. If your site is slow, caching, hosting and image size matter more. We cover those in how to improve your website performance.
What we see when clients come to us for maintenance
A lot of clients find BrandSwift when they need someone to maintain their website. When we check their sites, the same problems keep coming up.
Many of them are still running PHP 7.4. That version has had no security fixes since November 2022. The site still loads fine, so nobody notices. It matches the WordPress.org numbers above, where about 22% of sites were still on 7.4 in January 2026.
In some cases, plugins have not been updated for more than 3 years. Old plugins on an old PHP version is a risky mix. There are no security fixes from PHP, and none from the plugin either.
And it leads to hacking. Some of these sites had already been hacked by the time they came to us, with attackers injecting their own code into the site. We repair hacked websites as part of our maintenance work, but cleaning up after an attack costs more than keeping PHP and plugins up to date.
That is why the PHP upgrade should never be the first step on a site like this. Sort out the plugins first, then move PHP up.
What can break when you upgrade PHP
Most well-maintained sites move to a newer PHP version with no visible change. Problems come from old code. Watch for these:
- Abandoned plugins and themes. Anything not updated in two years or more is the usual cause of trouble.
- Removed functions. PHP 8.0 removed old functions such as create_function() and each(). Code that still uses them stops the page and shows “There has been a critical error on this website.”
- Stricter errors. PHP 8 treats many mistakes as errors that older versions only warned about.
- Custom code. Snippets added to functions.php years ago, or a custom plugin from a freelancer, often have not been tested on PHP 8.
The fix is usually simple: update or replace the plugin, or patch the custom code. The point is to find these problems on a test copy, not on your live site.
How to check your WordPress PHP version
- Log in to WordPress and go to Tools > Site Health > Info.
- Open the Server section. Your PHP version is listed there.
- Check the Status tab too. WordPress warns you when your PHP version is outdated.
On cPanel hosting, you can also see it under MultiPHP Manager or Select PHP Version, depending on your host.
How to update PHP for WordPress safely
- Back up first. Take a full backup of your files and database.
- Update everything else. Update WordPress core, your theme and all plugins on your current PHP version.
- Check your plugins. Look at each plugin’s last update date and required PHP version. Replace any plugin that is abandoned.
- Test on staging. Switch a staging copy to PHP 8.3 or 8.4. Click through your key pages, contact forms and checkout.
- Switch the live site. Change the version in cPanel. Make sure the same PHP extensions are turned on as before.
- Watch it for a few days. Check your error log and Site Health again.
If something does break, switch PHP back to the previous version in cPanel. It is a dropdown and takes a minute. Then fix the cause and try again.
Which PHP version should your WordPress site use?
- New website: PHP 8.4. The WordPress hosting team recommends 8.4 or 8.5 for new installs.
- Existing site on 8.3: You are fine until the end of 2027. Plan your move to 8.4 next year.
- On 8.2: Upgrade before 31 December 2026.
- On 7.4, 8.0 or 8.1: Upgrade now. You have had no PHP security fixes for some time.
Frequently asked questions
Does updating WordPress update PHP?
No. PHP runs on your hosting server and is set by your hosting company or in your cPanel. WordPress updates only change WordPress files.
Will upgrading PHP break my WordPress site?
Usually not, if your theme and plugins are kept up to date. Old or abandoned plugins are the main risk. Test on a staging copy first, and remember you can switch back in cPanel if needed.
Is PHP 7.4 still safe for WordPress?
No. PHP 7.4 reached end of life on 28 November 2022 and gets no security fixes. WordPress still runs on it for now, but that will not last.
What PHP version does WordPress 7 need?
WordPress 7 needs at least PHP 7.4. WordPress recommends PHP 8.3 or newer, and 8.4 or 8.5 for new installs.
How often should I check my PHP version?
Once a year is enough. Each PHP version gets about four years of support, so a yearly check gives you plenty of time to plan the next upgrade.
Need help with your WordPress PHP version?
If you are not sure which PHP version your site runs, or you are stuck on an old one because of a plugin, we can check it for you. Our web maintenance plans already cover WordPress core and plugin updates, backups and security improvement. We also offer WordPress hosting. Contact BrandSwift and tell us your website address.
About the author: Jerry Lim is the founder of BrandSwift, a web design and SEO agency in Kuala Lumpur. He leads BrandSwift’s WordPress, hosting and SEO work for clients in Malaysia, Singapore and Hong Kong.