--- title: "Do I need to update PHP? Will it break my site?" description: "Which PHP versions still get security fixes, how to check yours in WordPress, and how to update without breaking the site. Plain steps for site owners." source: "https://wardio.net/guides/update-php-version/" --- **For site owners** # Do I need to update PHP? Will it break my site? Your host sent an email about a PHP upgrade, or you read about a PHP security flaw and wonder if your website is at risk. This page explains what PHP is for your site, whether you need to act, and how to update without taking the site down. By David Kabel · Updated 2026-10-23 · 5 min read **The short answer** If your site runs PHP 8.1 or older, yes, update now: those versions no longer get security fixes. PHP 8.2 gets its last fixes on 31 December 2026. WordPress recommends PHP 8.3 or newer. Updating rarely breaks a site whose WordPress, theme and plugins are current. Take a backup, update everything else first, then switch PHP in your hosting panel and test. ## What PHP is, for your website PHP is the programming language WordPress, WooCommerce, Joomla, Drupal and many other website systems run on. It sits on the server, below your site. You never see it, but when PHP has a security flaw, every site on top of it can be affected. In October 2026, two flaws known as [PHP2Shell](/guides/php2shell-cve-2026-109618/) let attackers run their own code on servers without logging in. The fix was a PHP update. ## Which versions are still safe | PHP version | Security fixes until | What it means for you | | --- | --- | --- | | 8.5 | 31 Dec 2029 | Supported | | 8.4 | 31 Dec 2028 | Supported | | 8.3 | 31 Dec 2027 | Supported; the minimum WordPress recommends | | 8.2 | 31 Dec 2026 | Last security fixes this year; plan the move now | | 8.1 and older | Already ended | No fixes from the PHP project, including for PHP2Shell | ## Check which PHP your site runs In WordPress, open **Tools, Site Health**, click the **Info** tab and open **Server**. The PHP version is listed there. Your hosting control panel shows it too, usually under PHP settings or PHP version. Other systems show it in their admin area, or your developer can tell you. ## Update without breaking anything 1. **Take a backup.**: Use your host's backup tool or a backup plugin, and check you can download it. 2. **Update WordPress, your theme and every plugin first.**: Old plugins are by far the most common reason a PHP update breaks a site. Remove plugins you no longer use. 3. **Use a staging copy if your host offers one.**: Switch PHP on the copy first and click through the site there. 4. **Switch the PHP version in your hosting panel.**: Most hosts have a version selector. Pick 8.3 or newer. 5. **Test what earns you money.**: Checkout, contact forms, logins and search. Then look at a few ordinary pages. 6. **If something breaks, switch back and find the culprit.**: The error usually names the plugin or theme. Update it, replace it, or ask its developer. ## If you have your own server or VPS On shared hosting your host updates PHP itself and you only pick the version. On your own VPS or server, nobody updates PHP unless you or your developer do it, and security fixes such as PHP2Shell only arrive when someone installs them. That is the gap Wardio closes: we keep PHP and everything under it patched and confirm each fix. The [PHP2Shell guide](/guides/php2shell-cve-2026-109618/) shows the technical side. ## Gotchas - **Switching the version is not the same as updating it.** On a VPS, "PHP 8.3" can still be an old 8.3 release without the latest security fixes. The patch level matters, not only the number. - **Doing nothing is also a choice the host makes for you.** A host's upgrade email usually says what happens on the date if you do not act. Read it to the end, so the switch does not happen on a day you are not watching. - **Caching can hide problems.** After switching, clear your site's cache and test in a private browser window, or you may see the old working page. **How this was checked.** On 23 October 2026 we read the support dates from the PHP project's supported versions page and WordPress's recommended PHP version from its requirements page. The WordPress menu path was checked against the Site Health documentation. Not tested: the PHP switch on individual hosting providers, whose panels differ. ## Sources 1. [Supported Versions](https://www.php.net/supported-versions.php), PHP project 2. [Requirements](https://wordpress.org/about/requirements/), WordPress.org 3. [Site Health Screen](https://wordpress.org/documentation/article/site-health-screen/), WordPress documentation 4. [PHP News Archive 2026](https://www.php.net/archive/2026.php), PHP project, security release of 21 October 2026 ## Questions ### Do I need to update PHP? Yes, if your site runs a PHP version that no longer gets security fixes. As of October 2026 that is PHP 8.1 and older, and PHP 8.2 stops getting fixes on 31 December 2026. WordPress recommends PHP 8.3 or newer. An unsupported version stays exposed to bugs like PHP2Shell, the remote code execution flaws fixed on 21 October 2026. ### Will updating PHP break my WordPress site? Usually not, if WordPress, your theme and your plugins are up to date first. Breakage almost always comes from an old or abandoned plugin or theme. Take a backup, update everything else, switch the PHP version in your hosting control panel, and test your key pages. Most hosts let you switch back in a minute if something fails. ### How do I check which PHP version my WordPress site uses? In the WordPress dashboard, go to Tools, Site Health, then the Info tab, and open the Server section. It shows the PHP version the site is running. Your hosting control panel usually shows it too, often under a heading such as PHP settings or PHP version. ### My host says they are upgrading PHP. What do I need to do? Make sure WordPress, your theme and your plugins are up to date before the date your host gives, and take a backup. Then check the site the day after the switch, especially checkout, contact forms and logins. If something breaks, ask the host whether you can return to the old version temporarily while the faulty plugin is fixed or replaced. **Rather not do this yourself?** Tell me where your site is hosted and what it runs, and I will tell you whether it needs updating and what it would take. Free, no sales call. [Pricing](/pricing/). [Ask about my site](/contact/?topic=PHP%20update)