How to Check and Update Your Website's PHP Version
Find your site's PHP version in WordPress or your host's panel, pick a supported release before PHP 8.2 ends on Dec 31, switch safely and roll back if needed.
By Paul Peery
· 7 min read
If your website runs WordPress, it runs on PHP, and the PHP version is set by your host, not by WordPress updates. To check it, open Tools > Site Health > Info > Server in the WordPress dashboard. To change it, use the PHP setting in your hosting control panel (or ask your host), after a backup and a quick test. This week it's worth doing: PHP shipped a fix for two critical flaws on October 21, 2026, and PHP 8.2 stops getting security fixes on December 31, 2026. The whole job usually takes under an hour.
Why now#
On October 21, 2026, the PHP project published a security advisory for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that "can allow unauthenticated remote code execution". In plain terms, someone could run their own code on your server without logging in. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the advisory says "PHP 8.1 and older no longer receive updates from the PHP project."
WordPress followed the same day with a Critical PHP Security Release post. It asks site owners to update PHP immediately, notes that no WordPress update is needed because the flaw is in PHP itself, and says hosts may already be patching and adding firewall rules, but that you should still check. The UK's National Cyber Security Centre warned about the same issue, saying "organisations using any version of PHP are affected."
The second reason is the calendar. PHP's supported versions page lists these end dates at the time of writing:
| PHP branch | Security fixes until | Status today |
|---|---|---|
| 8.2 | Dec 31, 2026 | Security fixes only |
| 8.3 | Dec 31, 2027 | Security fixes only |
| 8.4 | Dec 31, 2028 | Active support |
| 8.5 | Dec 31, 2029 | Active support |
Each branch gets two years of bug fixes and two more of security fixes only, then nothing. A site on PHP 8.2 gets one final round of patches at most before the new year, and a site on 8.1 or older already gets none.
Does this affect your site?#
It depends on what your site is built with:
- WordPress sites run on PHP. Read on.
- Static sites (plain HTML, or Astro and Next.js sites exported to static files) on Netlify, Vercel, Cloudflare or GitHub Pages don't run PHP at all, so there's nothing to update. Our guide to hosting a static site for free covers those hosts.
- Next.js sites with a server run on Node.js, not PHP. Keep Next.js patched instead; see how to update Next.js safely.
- A static site on shared hosting with a PHP form script (a
contact.phpthat sends email, say) does run PHP for that script. Check the PHP version in your hosting panel the same way as below.
If you're not sure, log in to your hosting account and look for a PHP setting. If you have one, your hosting account can run PHP, and it's worth knowing which version it's on.
Step 1: Check your PHP version#
In WordPress, go to Tools > Site Health, open the Info tab and expand Server. The PHP version is listed there, along with settings such as the memory limit and maximum upload size. WordPress's Site Health documentation describes the screen, and the Status tab will flag "Your site is running an outdated version of PHP" as a critical issue when it applies.
Outside WordPress, your hosting control panel usually shows the version on the page where you change it (more on that in Step 4).
Then compare what you see with the list of fixed releases. If you're on 8.4.27 or 8.3.36, for example, you're patched. If you're on 8.4.20, your host hasn't applied the October fix yet: ask them when they will. If you're on 8.2 or older, plan a move to a newer branch.
Step 2: Pick the version to move to#
WordPress's update PHP page recommends PHP 8.3 or higher at the time of writing, and its compatibility table marks WordPress 7.0 and 7.1 as compatible with every PHP version from 7.4 to 8.5. So WordPress itself won't stop you; the question is your theme and plugins.
A practical rule: choose the newest branch your host offers that has active support (8.4 or 8.5 right now), unless a plugin you depend on says it doesn't support it yet. Each plugin's page on WordPress.org lists a minimum PHP version. If you'd rather take the smaller step, 8.3 still gets security fixes until the end of 2027.
Freeframe's WordPress themes require WordPress 7.1 and PHP 7.4 or later, which is listed in each theme's
readme.txt, so a newer PHP version won't fall below the theme's minimum.
Step 3: Back up and update everything else first#
PHP upgrades go wrong mostly because of old plugin or theme code, so do this first:
- Back up your files and database. Most hosts have a one-click backup; otherwise use a backup plugin. The WordPress update guide walks through both.
- Update WordPress, your plugins and your theme from Dashboard > Updates. Newer versions are far more likely to work on newer PHP.
- Remove plugins you don't use. A deactivated plugin is still code on your server, and one fewer plugin is one fewer thing to check.
- Use a staging copy if your host offers one. Switch PHP on the copy first, click through it, then repeat on the live site.
You may see the PHP Compatibility Checker plugin recommended for scanning plugins. At the time of writing its plugin page says it is "no longer actively maintained" and hasn't been tested with recent WordPress versions, so a staging test is more reliable.
Step 4: Change the PHP version#
PHP runs on your host's server, so the switch happens in your hosting account, not in WordPress. Look for a setting called something like PHP version, PHP settings or MultiPHP Manager.
On hosts that use cPanel, MultiPHP Manager works like this:
- Tick the checkbox next to your domain.
- Choose the new version from the PHP Version menu. Versions your host recommends are labeled "Recommended."
- Click Apply.
If your domain is set to inherit, it uses the server's default version, which only the host can change. Pick a specific version to take control of it. If the version you want isn't in the list, your host hasn't made it available to your account.
On managed WordPress hosts the setting is usually on the site's dashboard in your account. If you can't find it, email support. A short message is enough:
Hi, my site yourbusiness.example is on PHP 8.2. Could you tell me how to move it to PHP 8.4 (or 8.3 if 8.4 isn't available), and confirm the server has the October 21, 2026 PHP security fixes? Thanks.
Step 5: Test the site straight away#
Right after the switch, open a private browser window and check the pages that matter:
- the home page and two or three inner pages;
- the contact or booking form, by sending yourself a test;
- anything that takes payments, up to the checkout page;
- the WordPress dashboard, the Site Editor and the Site Health screen, which should now show the new version.
A blank page, an error message or a broken layout usually points to one plugin or theme that isn't ready for the new version. Update or deactivate it (under Plugins), then check again.
If something breaks, roll back#
Switching back is the same setting in reverse: choose the old PHP version and click Apply, and the site returns to how it was. WordPress's update PHP page makes one more point: if you need to restore a backup, ask your host to restore the previous PHP version first, then restore the backup.
Don't stay on an old version for long, though. Report the problem to the plugin's author with your WordPress and PHP versions, look for a maintained alternative on WordPress.org if they don't answer, and try the upgrade again.
If you manage your own server#
Most small-business sites are on shared or managed hosting, where the host patches PHP. If you run your own server, install the fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) from your Linux distribution's packages, since the advisory says distributions received the patches in advance. The advisory also lists temporary settings that reduce exposure, but it is clear that they "do not make an installation safe"; only the update does. And WordPress's post repeats the NCSC's advice for servers on PHP older than 8.2 that can't be updated yet: consider taking them offline until they can be.
A small calendar job for the rest of the year#
A new PHP branch arrives late each year and an older one stops getting security fixes on December 31, so a check like this once a year, alongside your WordPress updates, keeps a site on a supported version. If you're setting up a new WordPress site, our guide to installing a block theme covers the version checks to do on day one.
About the author
Paul Peery
Founder of Freeframe
Paul Peery runs Freeframe, which publishes complete multi-page website templates in HTML, Next.js, Astro and WordPress, and writes about getting small websites built, launched and kept up to date.
