Skip to content
SecurityPHP2Shell affects most WordPress sites. Am I affected? →
presscomet
Security

How to check and update your PHP version in WordPress (2026)

Your PHP version decides whether your WordPress site still gets security fixes. Here’s how to find it in under a minute, what’s still supported, and a safe way to upgrade without breaking anything.

By the Presscomet teamPublished 11 min read

On this page
  1. Why your PHP version matters
  2. Which versions are supported?
  3. How to check your version
  4. How to upgrade safely
  5. Fixing errors after switching
  6. Rolling back
  7. Fewer upgrades to babysit

Why your PHP version matters

WordPress is written in PHP, and PHP is a program installed on your server. Like any program it gets bug fixes and security fixes, but only for a few years per version. When a version reaches end of life, the PHP project stops fixing it, and any new security hole stays open unless your host patches it themselves.

That stopped being theoretical in October 2026. The PHP2Shell vulnerabilities hit every PHP version, and supported versions got a fix the same day. Sites on PHP 7.4, 8.0 or 8.1 had to wait for their host or Linux distribution to backport one, and sites on anything older got no fix at all.

WordPress recommends
PHP 8.3 or newer
WordPress still runs on
PHP 7.4+ (with a warning)
PHP 8.2 security fixes end
31 Dec 2026
PHP2Shell-fixed releases
8.5.12 · 8.4.27 · 8.3.36 · 8.2.35

There’s often a speed bonus too: newer PHP releases tend to run WordPress at least as fast as older ones, so an upgrade rarely costs performance and can save time on every uncached page view.

Which PHP versions are still supported?

Pick your version to see where it stands. Support dates come from php.net; the PHP2Shell column shows the first fixed release on each branch.

Interactive lookup

Is my PHP version still supported?

PHP 8.1

End of life
Support
No longer supported by the PHP project
PHP2Shell fix
Vendor/distro backport only

Only patched if your host or Linux distribution backports fixes. Upgrade.

Dates from php.net’s supported-versions page, checked 2026-10-23. Distributions such as Ubuntu and Red Hat support their own PHP packages on their own schedule.

Distribution builds play by their own rules

Ubuntu, Debian, Red Hat and some hosts keep shipping security fixes for PHP versions the PHP project has retired, often without changing the version number. Ubuntu 24.04’s PHP2Shell-patched package, for example, still reports 8.3.6. If your host is one of these, “supported” means “supported by your host” — ask them.

How to check your PHP version in WordPress

Any of these work. Site Health is the most reliable because it reports the PHP that actually answers your visitors’ requests.

  1. Open Tools › Site Health ①.
  2. Click Info ②, then expand Server.
  3. Read PHP version ③. PHP SAPI ④ shows how PHP runs (fpm-fcgi, apache2handler, litespeed…).
yoursite.com/wp-admin/site-health.php?tab=debug

Site Health

StatusInfo

Server ▴

Server architectureLinux 6.8.0 x86_64
Web servernginx/1.26.2
PHP version8.3.14 (Supports 64bit values)
PHP SAPIfpm-fcgi
PHP max input variables1000
PHP time limit30
PHP memory limit256M

Other panels: WordPress, Directories and Sizes, Drop-ins, Active Plugins, Database…

Tools › Site Health › Info › Server. Illustration — your values will differ.

The Status tab also warns you when your PHP is outdated, and very old versions trigger a “PHP Update Required” box on the Dashboard.

How to upgrade PHP safely

The upgrade itself is a dropdown. The work is making sure nothing on your site depends on something the new PHP removed. Use the checklist as you go; it saves your progress in this browser.

Interactive checklist

PHP upgrade readiness

0/10

checked

Before you switch
Switch and test

Ticks are saved in this browser only, so you can come back later.

  1. Step 1: Choose your target

    Go to PHP 8.4 if your plugins support it, or 8.3 if you want the version WordPress.org has recommended longest. Avoid jumping to a brand-new release on day one.

  2. Step 2: Turn on the error log, not the error display

    Add the lines below to wp-config.php above “That’s all, stop editing!”. Remove them when you’re done.

  3. Step 3: Switch on staging, then live

    Use the same panel screen you checked the version on. Changes usually apply within a minute.

  4. Step 4: Watch debug.log for a day

    New Fatal error lines mean something broke; Deprecated lines are warnings to pass on to the plugin author.
wp-config.php — log errors without showing them to visitors
define( 'WP_DEBUG', true );define( 'WP_DEBUG_LOG', true );      // writes wp-content/debug.logdefine( 'WP_DEBUG_DISPLAY', false );  // never print errors on the page

On your own server?

Install the new PHP alongside the old one (for example php8.4-fpm next to php8.1-fpm), install the same extensions WordPress needs (mysqli, curl, gd or imagick, mbstring, xml, zip, intl), point the site’s web server config at the new socket, and restart. Switching back is then one config line.

Fixing common errors after switching

“There has been a critical error on this website”

A plugin or theme hit a fatal error. WordPress emails the admin address a link to recovery mode, which lets you log in with the broken plugin paused. Open debug.log: the line mentioning wp-content/plugins/<name> tells you which one. Update it, replace it, or switch PHP back while you sort it out.

A blank white page

The same thing, but with errors hidden and no recovery email (sometimes the mail never arrives). Rename the suspect plugin’s folder over SFTP to deactivate it, or switch PHP back.

“Call to undefined function create_function()” or “each()”

Both functions were removed in PHP 8.0. Code that still uses them is very old; the plugin needs an update or a replacement.

“Deprecated: Creation of dynamic property…”

A PHP 8.2+ warning, not an error. The site works; the plugin author should fix it in a future release. Keep WP_DEBUG_DISPLAY off so visitors never see it.

“Your PHP installation appears to be missing the MySQL extension”

The new PHP version doesn’t have the mysqli extension enabled. In cPanel’s Select PHP Version, tick it under Extensions; on your own server install php8.x-mysql and restart.

Rolling back

If something important breaks and you can’t fix it quickly, switch back to the previous version in the same panel. That’s why you checked it first. Then fix the cause on staging and try again within days, not months: an old PHP version is a security debt that only grows.

Rolling back below a fixed version

Rolling back from 8.3 to an unpatched 8.1 reopens PHP2Shell. If you must roll back, make sure the older version on your host is a patched build, and set a date to try again.

Fewer upgrades to babysit

PHP upgrades never stop: a new version every year, each supported for about four. Most site owners keep up by putting the job on someone else — a managed host that patches PHP for them. Ask yours these questions to check they actually do.

The other route is to stop running PHP. Presscomet keeps the WordPress admin, block editor, URLs and content, but runs on Node.js with no PHP runtime, so there’s no PHP version to track at all. It’s a different platform with its own updates (Node.js and its libraries still need patching), and it doesn’t run PHP plugins or WooCommerce, so read Can you run WordPress without PHP? or Presscomet vs WordPress before deciding. If it fits, the migration only reads your old site, so trying it is risk-free.

Sources

Facts checked against these sources on October 23, 2026. Things change quickly; the vendor advisory always wins.

  1. [1]Supported versions — PHP.net
  2. [2]Server requirements — WordPress.org
  3. [3]PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 security releases — PHP.net
  4. [4]Debugging in WordPress — WordPress Developer Resources
  5. [5]USN-8948-1: PHP vulnerabilities — Ubuntu
  6. [6]PHPCompatibility for PHP_CodeSniffer — GitHub

Frequently asked questions

How do I check my PHP version in WordPress?

Log in to wp-admin and go to Tools › Site Health, open the Info tab and expand Server. The PHP version row shows the version serving your site. Your hosting control panel (cPanel MultiPHP Manager, Select PHP Version, or your host’s dashboard) shows it too.

What PHP version does WordPress need?

WordPress.org recommends PHP 8.3 or greater. WordPress still runs on PHP 7.4 and later, but versions before 8.2 no longer receive security updates from the PHP project, so they are only safe if your host or Linux distribution backports fixes.

Is PHP 8.1 end of life?

Yes. The PHP project no longer supports PHP 8.1 or older. Some Linux distributions and hosts still patch their own 8.1 builds (for example Ubuntu 22.04), but you should plan a move to PHP 8.3 or 8.4.

When does PHP 8.2 reach end of life?

PHP 8.2 receives security fixes until 31 December 2026. After that, the PHP project releases no more fixes for it.

Will updating PHP break my WordPress site?

It can if a plugin or theme uses code that newer PHP removed. That is why you update plugins and themes first, test on staging, and keep the previous PHP version available so you can switch back in a minute.

Can I update PHP from inside WordPress?

No. PHP is installed on the server, not in WordPress. You change it in your hosting control panel or ask your host; on your own server you install new packages and restart PHP.

Why does php -v show a different version than Site Health?

A server can have several PHP versions installed. php -v shows the command-line PHP; Site Health shows the PHP that answers web requests for your site, which is the one that matters for security.

Run WordPress without a PHP runtime to patch.

Presscomet keeps your wp-admin, editor, URLs and content, and serves pages without PHP or MySQL. Check your site for free, then migrate in one click — your old site is only ever read.

Check my site

Keep reading