Your host says your PHP version is out of date. What that means

An email arrives from your hosting company. It says your website is running an outdated version of PHP and asks you to upgrade. Or you log into WordPress and the dashboard shows a notice saying the same, with a red label beside it. Either way it reads like a message meant for somebody else.

It is meant for you, and it deserves a few minutes of your time. The short version: your site may be running on software that no longer gets security fixes, the move to a newer version is usually painless, and you can try it on a copy of the site before the real one is touched.

What PHP is

WordPress is written in a programming language called PHP. Every time somebody visits a page, the server runs WordPress’s PHP code to build that page from your content and send it to their browser. Your plugins and your theme are written in PHP too.

PHP itself is software, maintained by a group of volunteers and companies, and it comes in numbered versions: 7.4, 8.0, 8.1 and so on. Your host installs one or more of those on the server, and your site runs on whichever one it has been set to. Nobody on your side changes it unless they log into the control panel and pick a different one, which is why a site built in 2020 can still be on the version it was built with.

Why an old version is a risk

Each PHP version is supported for four years from its release. For the first two it gets bug fixes and security fixes. For the next two it gets security fixes only. After that it reaches what PHP’s own site calls end of life, and from then on it gets nothing. When somebody finds a hole in it, the hole stays open.

As of today, according to php.net:

• PHP 8.1 and everything older are past end of life. That includes 7.4, which a lot of older WordPress sites still run on.
• PHP 8.2 gets security fixes until 31 December 2026, eight weeks from now.
• PHP 8.3 gets security fixes until the end of 2027.
• PHP 8.4 is fully supported until the end of 2026, and gets security fixes until the end of 2028.

If you are on 8.1 or older, the language your whole site runs on has stopped being patched. If you are on 8.2, it is about to. Keeping WordPress and your plugins up to date does not cover this, because the gap sits underneath all of them.

Newer versions of PHP also tend to run WordPress faster, and your pages may load a little quicker after the move. That is a pleasant side effect. The reason to move is the security fixes.

Hosts know all this, which is why they send the email. Some will move you to a newer version themselves after a deadline, whether or not the site is ready, and that is how a site that nobody has touched for months ends up broken one morning.

What can break when you upgrade

WordPress itself copes well with new PHP versions. The risk sits with your plugins and your theme.

Each new PHP version removes a few old ways of doing things. A plugin that is still maintained gets updated to match, usually well before the new version is common. A plugin that was last updated four years ago has not been, and when it reaches a piece of PHP that no longer exists, it stops. On a live site that can mean a white page, or the message “There has been a critical error on this website”. Our post on the WordPress white screen covers what to do if that happens.

You can get a fair idea of the risk before you start. In the dashboard, go to Plugins and look at each one’s details on WordPress.org. Note the date it was last updated, and treat anything untouched for more than a couple of years as suspect. Do the same for your theme, especially if a developer built it for you and has since moved on. A custom theme is the piece most likely to have never been tested on anything newer than the version it was written for.

The other thing to check is WordPress itself. Under Tools, then Site Health, WordPress shows which PHP version the site is on and flags it if it is too old. Make sure WordPress, your plugins and your theme are all updated before you change PHP, so you are testing the newest versions of everything rather than code that already has fixes waiting.

Test it on a copy first

Do not switch the live site and hope. Make a copy and switch that.

Make a staging copy. Many hosting control panels have a staging option that copies the site to a private address in a couple of clicks. If yours does not, a backup plugin can usually restore a copy to a subdomain. Either way you end up with a second site that nobody visits and nothing depends on.

Change PHP on the copy only. In the control panel, find the PHP version setting for the staging site and move it to 8.3 or 8.4. Going from 7.4 straight to 8.4 is fine; you do not need to stop at each version on the way.

Then check it properly. Load the home page and a few inner pages. Submit the contact form and check the email arrives. If you sell online, add something to the basket and go as far as the payment page. Log into the dashboard and open the plugin settings pages, because some faults only show up there. Look at the host’s PHP error log for the staging site as well, since a plugin can complain there without breaking anything you can see.

If something fails, the error log will usually name the plugin or theme responsible. Update it if an update exists. If it has been abandoned, look for a maintained replacement and test that on the copy too. Keep going until the copy runs cleanly on the new version.

Then do the live site. Take a fresh backup, switch the live site to the same PHP version, and run the same checks. Do it on a weekday morning when you are around to look, rather than on a Friday evening.

Most control panels let you switch back to the old version in seconds if something slips through. Use that as a way out for a day or two while you fix the cause, rather than as a place to stay.

If you are on a plan that handles this

On a well-run hosting setup, nobody should need to send you this email. Somebody tests the newer version against your site, fixes or replaces what does not cope, and moves you across before the old one runs out. If your host leaves that to you, it is worth asking what else is left to you as well. Our post on shared hosting compared with a dedicated server goes into the difference that makes.

The short version

An out-of-date PHP warning means the language your site runs on has stopped getting security fixes, or soon will. Moving to 8.3 or 8.4 is a setting at your host. The care goes into testing it on a copy first, because the thing that breaks is an old plugin or theme, and you would rather find that on a site nobody visits.

If you would like somebody to do the testing and the move for you, our Care & Hosting plan keeps your site on a supported PHP version as part of the job, for £49 a month, and we move your site across for free.