If you weren’t living under a rock this November and you run a business using WordPress or any form of PHP on your website, then you may have been aware of the global hack that took down hundreds of thousands of websites because of security flaws that were discovered by AI. If you weren’t living under a rock this November and you run a business using WordPress or any form of PHP on your website, then you may have been aware of the global hack that took down hundreds of thousands of websites because of security flaws that were discovered by AI.

For those of you who knew it happened and know that you’re using PHP but don’t know all of the details, this may be an interesting article for you to understand what PHP is and how it is used on the internet and your websites. For example, every WordPress website runs on a piece of software called PHP, and each version of PHP stops receiving security fixes on a published date. The version many sites use today, PHP 8.2, reaches that date on December 31, 2026, so your site may be affected even if nothing about it has changed. This article explains what a PHP version is, what “end of life” means, how to check yours, and what your options are.

What is a PHP version?

PHP is the programming language that WordPress is written in. When someone visits your site, the server, which is the computer at your hosting company that stores and delivers your website, uses PHP to build each page. It pulls your text, images and settings from a database and turns them into the page the visitor sees.

PHP comes out in numbered versions. A new version arrives about once a year, usually in November. Your hosting company decides which versions it offers, and someone (you, your developer or the host) picks one for your site. For example, two identical WordPress sites at the same host could run on PHP 7.4 and PHP 8.3, and a visitor would see no difference between them.

The version matters because it decides whether the software underneath your site still gets security fixes. Your PHP version is separate from your WordPress version. You can be on the newest WordPress and still run an old version of PHP.

What “end of life” means for PHP

The group that maintains PHP supports each version in two stages, according to the official PHP supported versions page:

  • Active support. For about two years after release, reported bugs and security problems are both fixed, and updates come out on a regular schedule.
  • Security fixes only. For about two more years, only critical security problems are fixed, and updates come out only when needed.
  • End of life. After that, the version gets no fixes of any kind. If a new security flaw is found, it stays open for every site still running that version.

Here are the current dates from the same page:

  • PHP 8.1. Reached end of life on December 31, 2025. PHP 8.0 and 7.4 reached it earlier.
  • PHP 8.2. Security fixes end on December 31, 2026.
  • PHP 8.3. Security fixes continue until December 31, 2027.
  • PHP 8.4. Active support ends December 31, 2026; security fixes continue until December 31, 2028.
  • PHP 8.5. Released in November 2025, with security fixes until December 31, 2029.

What changes on December 31

On December 31, PHP 8.2 joins the versions that no longer get security fixes. Your site will keep working the next morning. Nothing switches off. The change is that any new security flaw found in PHP 8.2 after that date will not be fixed by the people who make PHP.

Hosting companies tend to respond to these dates in one of three ways:

  1. They remove the old version. WP Cloud, a WordPress hosting platform run by Automattic (the company behind WordPress.com) that other hosts and agencies build on, will remove PHP 8.2 on December 15, 2026 and expects hosts to move their customers before then.
  2. They charge to keep it. IONOS, a large web host, offers paid Extended Support for older versions. It does not change your version for you. After a free transition period, it adds a monthly fee if you neither upgrade nor cancel.
  3. They extend support for a while, then prompt you. GoDaddy says its extended support for PHP 7.4 on its managed WordPress plans runs until November 2026, and it shows a “PHP Update Required” message in the WordPress dashboard.

Your host may do one of these, a mix, or something else. The notice usually arrives by email to whoever set up the hosting account, which is not always the person who looks after the site today.

How many sites run an older PHP version

A large share of WordPress sites run PHP versions that are already past end of life or close to it. In January 2026, the WordPress core team, the group of volunteers and companies that build WordPress, published usage figures from the sites it monitors:

  • About 27 percent ran PHP 8.2. This is the version that reaches end of life on December 31.
  • About 47 percent ran PHP 8.1 or older. That includes about 22 percent on PHP 7.4, which stopped getting fixes at the end of 2022.
  • About 22 percent ran PHP 8.3 or newer. These versions still receive security fixes into 2027 and beyond.

Put together, about three in four monitored WordPress sites were running a version that would be unsupported by January 2027. Some of those sites have upgraded since then. Notes from a WordCamp US 2026 discussion (WordCamp is WordPress’s community conference) put PHP 7.4 at about 18 percent in September, and observed that few site owners have had a strong reason to upgrade.

WordPress itself still allows older versions. With WordPress 7.0, the lowest PHP version it supports became 7.4. The version WordPress recommends is PHP 8.3 or newer. “Supported by WordPress” and “still receiving security fixes from PHP” are two different things, and only the second protects your site from newly found flaws.

Why this matters even if your site works fine

A site on an old PHP version usually looks and works exactly as it did before. That is the reason this is easy to miss. The effects show up in other places:

  • Security. Your site’s protection depends on every layer being fixed when a flaw is found: WordPress, plugins, your theme, and PHP underneath them. An end-of-life PHP version leaves the software underneath everything else without fixes. We covered the plugin layer in our article on the October WordPress plugin attacks.
  • Plugin updates. Plugin makers set their own minimum PHP version. Over time, a plugin’s new versions may require a newer PHP than your site runs. When that happens, your site stays on the plugin’s older version and misses its fixes too.
  • Hosting costs and deadlines. As described above, your host may add a fee or set a removal date. If the host moves your site to a new version on its own schedule, the change can happen on a day when nobody is watching the site.
  • Security reviews. If your business answers security questionnaires from customers or insurers, or follows payment card security rules, those reviews may ask whether your server software is still supported.

Speed is a smaller factor than you might expect. Benchmarks from Tideways, which makes performance tools for PHP, found WordPress ran at about the same speed on PHP 8.2, 8.3 and 8.4, while PHP 7.4 handled about 5 percent fewer requests per second than PHP 8. The main reason to update is to keep receiving security fixes, not to gain speed.

What can go wrong when you update PHP

Most of the work in a PHP update is checking that your plugins and theme still work. WordPress itself is tested against new PHP versions before they are recommended. Plugins and themes are made by many different companies, and each one is responsible for its own code.

When a plugin or theme has not been updated for a newer PHP version, the problems usually look like one of these:

  • A feature quietly stops. For example, your contact form still appears, but submissions no longer reach your inbox.
  • A page shows an error. WordPress may display “There has been a critical error on this website” instead of the page.
  • The admin area misbehaves. A settings screen fails to save, or the editor will not load.

The WordPress core team says reported compatibility problems with recent PHP versions are now very few. The risk is concentrated in sites with older custom themes, plugins that are no longer updated by their makers, and custom code written years ago. A site built recently on well-maintained plugins usually moves to a new PHP version with little or no trouble.

How to check your PHP version

You can find your PHP version in a few minutes without any technical tools. Use either of these:

  1. Inside WordPress. Log in as an administrator, go to Tools, then Site Health, then the Info tab, and open the section labeled Server. The PHP version is listed there. The Site Health status tab may also show a notice if your version is out of date.
  2. In your hosting account. Most hosts show the PHP version in the control panel for each site, often under a heading such as PHP Settings or PHP Version. This is also where it is usually changed.

While you are there, write down three things: the PHP version, the WordPress version, and the list of active plugins. Those three pieces of information are what a developer will ask for first.

What helps an update go smoothly

Four things make a PHP update low-risk:

  1. A staging site. A staging site is a private copy of your website, usually provided by your host, where changes can be tested without affecting what visitors see. Switch the copy to the new PHP version first.
  2. A recent backup. Make a full backup of the site’s files and database just before the change, and confirm you know how to restore it. Most hosts let you switch the PHP version back, but a backup covers anything else that goes wrong.
  3. Updated plugins and theme. Update WordPress, plugins and your theme before you change PHP. Many compatibility fixes are already in the newest versions. Remove plugins you no longer use.
  4. A short test list. Check the pages and features that matter most to your business: the home page, a few key service or product pages, every form, the checkout if you sell online, and logging in to the admin area.

On a well-maintained site, this is often a few hours of work. On a site with an old custom theme or abandoned plugins, testing may turn up items that need a developer.

Your four options

Every site owner on PHP 8.2 or older has the same basic choices:

  1. Update to PHP 8.3 or 8.4 now. This keeps you on supported versions into 2027 or 2028 and avoids host deadlines. It takes testing time, and an older site may need some fixes first.
  2. Pay your host for extended support. Some hosts, such as IONOS, keep patching old versions for a monthly fee. This buys time without changing the site, but it adds a recurring cost and only delays the update.
  3. Wait for your host to move you. This takes no effort now. The trade-off is that the change happens on the host’s schedule, and a problem may be noticed first by a customer.
  4. Rebuild or replace the site. If testing shows the theme or key plugins can’t run on a current PHP version, and a redesign was already being considered, the update can become part of that project. It costs the most, and it replaces the parts that cannot run on a current PHP version.

Any of these can be the right choice for a given business. The useful step is to decide on purpose, so the update happens on a schedule you choose.

Deciding who looks after it

This question often has no clear answer, which is why old versions linger. The hosting company provides the PHP versions. The developer or agency that built the site may have chosen the version at launch. After launch, the job of updating it often belongs to nobody in particular.

It helps to name one person or company responsible for it. If you have a website maintenance agreement, check whether it covers PHP updates and testing, or only WordPress and plugin updates. If you manage the site yourself, add a yearly reminder for December, when one PHP version reaches end of life each year, to check your version against the supported versions page.

Also confirm whose email address is on the hosting account. Host notices about PHP removals and fees go there. If that address belongs to a former employee or a past agency, the notice may never reach anyone who can act on it.

Where to start

Nothing breaks on December 31, and checking where you stand takes only a few minutes. A reasonable plan for the next month looks like this:

  • Check your PHP version. Use Tools, then Site Health, then Info, then Server, or your hosting control panel.
  • Look for notices from your host. Search the email on the hosting account for “PHP” and note any removal dates or fees.
  • Update WordPress, plugins and your theme. Remove anything you no longer use, then make a full backup.
  • Test PHP 8.3 or 8.4 on a staging copy. Go through your test list of key pages, forms and checkout before switching the live site.
  • Name who owns this going forward. Decide whether it sits with you, your developer or a maintenance plan.

If you’d like help with any of it, that’s work we do every day.