In late 2026, a WordPress website should run PHP 8.3 or 8.4, or 8.5 once your plugins are confirmed to work with it. PHP 8.1 and older get no security fixes at all, and PHP 8.2 joins them on 31 December 2026. An old version won’t break your site overnight, but it leaves holes that will never be patched, and it slowly locks you out of plugin and WordPress updates.
Key takeaways
- WordPress recommends PHP 8.3 or newer. PHP 8.2’s security support ends on 31 December 2026.
- About a third of WordPress sites still run PHP 8.1 or older, which no longer gets security fixes.
- The main reason to upgrade is security and compatibility. Speed gains between PHP 8 versions are small.
- Back up, update everything, test on a staging copy, then switch. Most upgrades take minutes.
What does the “outdated PHP version” warning mean?
PHP is the programming language WordPress is written in. Your web server runs it every time someone loads an uncached page. Your host chooses the PHP version, not WordPress, so nothing inside your dashboard fixes the warning.
WordPress shows a “PHP Update Required” or “PHP Update Recommended” notice when your server’s version falls behind. To see your exact version, go to Tools, then Site Health, then the Info tab, and open the Server section (WordPress.org).
Which PHP version should your website run in 2026?
Each PHP version gets two years of bug and security fixes, then one or two more years of security fixes only, then nothing. Here’s where things stand, according to the PHP project:
| PHP version | Security fixes until | Our view |
|---|---|---|
| 7.4 and older | Already ended | Upgrade now |
| 8.0 and 8.1 | Already ended | Upgrade now |
| 8.2 | 31 December 2026 | Plan the move this month |
| 8.3 | 31 December 2027 | Safe, widely tested choice |
| 8.4 | 31 December 2028 | Good choice for most sites |
| 8.5 | 31 December 2029 | Fine once your plugins support it |
WordPress recommends PHP 8.3 or greater. WooCommerce asks for the same, and says it’s tested up to PHP 8.4 (WooCommerce). WordPress core itself works on PHP 8.5, but some plugins and themes take longer to catch up, so the newest version isn’t always the right first step.
Is an old PHP version dangerous?
Yes, slowly and quietly. Three things happen when a site stays on an unsupported version.
- Security holes stay open. When a flaw is found in an old PHP version, nobody fixes it. WordPress.org says versions past end of life “may expose your site to security vulnerabilities”.
- Plugin updates stop. Developers set a minimum PHP version. Once yours falls below it, WordPress won’t offer you the update, including security patches for that plugin.
- WordPress itself leaves you behind. WordPress 7.0 and later need at least PHP 7.4 (WordPress Core Handbook). Sites on older PHP are frozen on old releases.
The second point matters most. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins (Patchstack). A site that can’t install plugin fixes is exposed to all of them.
This isn’t rare. WordPress.org’s usage statistics show about 32% of WordPress sites on PHP 8.1 or older in November 2026. Another 22% run PHP 8.2, which stops getting fixes at the end of the year.
Will a newer PHP version make my site faster?
A little, unless you’re coming from something very old. Independent testing by Tideways found WordPress handled about 5% fewer requests on PHP 7.4 than on PHP 8.x, and no significant change in response times from 8.4 to 8.5 (Tideways).
So upgrade for security and compatibility, and treat any speed gain as a bonus. If your site feels slow, WordPress caching makes a far bigger difference. If you’re also wondering whether a CDN would help, our guide to do I need a CDN covers that question for Australian audiences.
How do you upgrade PHP safely?
Most upgrades go smoothly. The ones that break usually involve an abandoned plugin or theme. This order keeps the risk low:
- Check your current version. Use Site Health, or ask your host.
- Take a fresh backup. Make sure it’s stored off the server and that you know how to restore it.
- Update everything first. Update WordPress, your theme and every plugin, then check the site still works.
- Look for abandoned plugins. Anything not updated in a year or more is a warning sign. Ask the developer about PHP 8.3 support, or replace it.
- Test on a staging copy. Switch the staging site to the new version and click through your key pages, forms and checkout.
- Switch the live site. Choose a quiet time, then retest the same pages. If something breaks, switch back while you fix it.
Who should look after your PHP version?
Your host controls which PHP versions are available and should warn you before an old one is removed. Good WordPress hosting in Australia offers current versions, lets you switch per site and includes staging so you can test first.
Checking plugin compatibility and testing the site is maintenance work. If nobody owns that job, our WordPress maintenance services include core, theme and plugin updates, plus monthly reporting. To compare resources and support levels, see our hosting plans.
Frequently asked questions
How do I check which PHP version my WordPress site uses?
In your WordPress dashboard, go to Tools, then Site Health, then Info, and open the Server section. The PHP version is listed there. Your hosting control panel usually shows it too, and your host can tell you if you don’t have access.
Can updating PHP break my website?
It can, usually because an old plugin or theme uses code that newer PHP no longer accepts. That’s why you update everything first, test on a staging copy and keep a backup. If the live site breaks, switching back to the previous version restores it while you fix the cause.
Should I go straight to PHP 8.5?
Only if your theme and plugins say they support it. WordPress core runs on PHP 8.5, but WooCommerce lists itself as tested up to 8.4. For most small business sites, PHP 8.3 or 8.4 is the safe choice in late 2026, with 8.5 a sensible next step during 2027.
Can I update PHP myself?
Many hosts let you pick a PHP version in the control panel, so the switch itself is easy. The work is in the preparation: backups, updates, compatibility checks and testing. If your host doesn’t offer a switch, ask them to change it for you.
Is PHP 8.2 still safe to use?
It gets security fixes until 31 December 2026, and nothing after that. If you’re on 8.2 now, plan the move to 8.3 or 8.4 before the end of the year, while you can test calmly rather than in a rush.
Sources
- Supported versions, PHP.net, November 2026
- Requirements, WordPress.org
- Get the latest PHP: update now, WordPress.org
- PHP compatibility and WordPress versions, WordPress Core Handbook, updated 4 November 2026
- WordPress statistics: PHP versions in use, WordPress.org, November 2026
- Server requirements, WooCommerce
- State of WordPress Security in 2026, Patchstack
- PHP Benchmarks: 8.5 vs 8.4, 8.3 and 7.4, Tideways, 19 November 2025