How to Check and Update Your PHP Version Safely

Key takeaways

PHP 8.1 and older have had no security fixes since the end of 2025.
PHP 8.2 gets fixes only until December 31, 2026. If you run it, plan the switch now.
Several hosts charge extra for outdated versions, IONOS for example 7.81 euros a month for PHP 8.1.
WordPress warns you in Site Health when your PHP version is outdated.
At most hosts, a PHP switch can be undone with one click.

Why your PHP version matters

PHP is the language WordPress and many other systems use to build each page on the server, every time someone visits. Each PHP version gets two years of full support, then two years of security fixes only. After that it is over: new holes in that version are no longer closed. How fast that becomes serious was shown by the PHP2Shell vulnerability of October 2026, which affected almost every PHP version at once and was only fixed in the supported ones.

Which PHP versions are still safe?

Version	Full support until	Security fixes until	Status, October 2026
8.5	Dec 31, 2027	Dec 31, 2029	Current
8.4	Dec 31, 2026	Dec 31, 2028	Current
8.3	Dec 31, 2025	Dec 31, 2027	Security fixes only
8.2	Dec 31, 2024	Dec 31, 2026	Security fixes only, ending soon
8.1	Ended	Dec 31, 2025	No more fixes
8.0 and older	Ended	2023 or earlier	No more fixes

Source: php.net supported versions. PHP 8.6 is planned for November 19, 2026. Until your plugins and theme have caught up with it, 8.4 or 8.5 is the safe choice.

WordPress recommends PHP 8.3 or newer (WordPress requirements). Since WordPress 7.0 (May 2026) it needs at least PHP 7.4, so sites on PHP 7.2 or 7.3 are stuck on WordPress 6.9 (announcement).

How to check your PHP version

In WordPress

Go to Tools, then Site Health, open the Info tab and the Server section. The entry "PHP version" shows what your server runs. If it is outdated, the Status tab also lists a critical issue saying your site is running an outdated version of PHP that should be updated.

At your host

Your host's control panel shows the version, and that is also where you change it. The paths at common hosts in Germany, as documented on their help pages:

IONOS: Menu, Hosting, the PHP tile "Verwalten", then click the domain or "PHP-Version auswählen" (help page).
STRATO: customer login, "Datenbanken und Webspace", "PHP-Version" (FAQ).
All-Inkl: KAS, click the domain or subdomain, "PHP-Version". A PHP version set in .htaccess overrides this setting (guide).
webgo: hosting contract, Domains, the gear icon, "PHP Version" (FAQ).
Hetzner: konsoleH, your hosting, Services, "PHP Configuration" (docs).

One catch: the number is not the whole story

Linux distributions such as Debian patch the version they ship and keep the old version number (Debian security FAQ). A number that looks old can still contain the latest fixes, and a host may run a patched build. If in doubt, ask your host whether a specific fix is installed.

What outdated PHP versions cost

Several German hosts now charge a monthly fee if you keep running a version past its end of life, usually called "PHP Extended Support":

Host	Fee for outdated versions (as of October 2026)
IONOS	PHP 8.1: 7.81 euros a month. PHP 7.4 and 8.0: 15.62 euros. PHP 7.0 to 7.3: 18.28 euros (price page)
webgo	PHP 8.0 and 8.1: 2.99 euros a month. PHP 7.x: 3.99 euros, incl. VAT. PHP 8.2 free until the end of 2026 (price page)
STRATO	Fee for PHP 8.1 since March 2, 2026, described as a small monthly charge without a public amount (FAQ)

The fee buys time, not safety. It is one of the quieter items in what website maintenance really costs.

How to update PHP without breaking your site

Make a backup of files and database, through your host or a backup plugin.
Update WordPress, plugins and theme first. Older plugins and themes are often not ready for new PHP versions. Our guide on checking your plugins helps you spot abandoned ones.
Check compatibility. The PHP Compatibility Checker plugin can help, but WordPress.org notes that it can miss problems and raise false alarms (WordPress.org guide). For plugins without updates in years, ask the developer or replace them.
Test on a staging copy if your host offers one.
Switch the version in the control panel, then click through your most important pages and send a test message through every form.
If something breaks: since WordPress 5.2 there is a recovery mode. On a fatal error, visitors see a short notice about technical difficulties, and the admin email receives a link that lets you pause the failing plugin or theme (WordPress core). Or switch the PHP version back in the control panel.

Then put a reminder in your calendar. With four years per version, the next switch is never far away.

Or: a website without a PHP version

Every PHP version runs out after four years, so this job comes back. A static website has no PHP version to look after at all, because it only delivers finished files. That is how sites on ShiftPress work: every page is built ahead of time as HTML and served through Cloudflare, with no PHP on the server. More on why WordPress keeps creating jobs like this in why WordPress feels like work.

Frequently asked questions

Which PHP version should I use?

PHP 8.4 or 8.5, as long as your plugins and theme support it. PHP 8.3 still gets security fixes until the end of 2027. WordPress recommends 8.3 or newer.

Can a PHP update break my website?

Yes, if a plugin or the theme is not compatible with the new version. That is why you make a backup, update everything first and test. At most hosts you can switch back with one click.

How often do I need to update PHP?

Each version gets four years of fixes in total. In practice, plan a switch about every two years so you are never on a version close to its end.

What happens if I do nothing?

The site keeps running, but new security holes in your version are no longer fixed, and many hosts charge a monthly fee for outdated versions.

Does a WordPress update change my PHP version?

No. PHP runs on the server and is set by your host. WordPress updates and PHP updates are separate.

Do I need a PHP version on ShiftPress?

No. ShiftPress sites are finished HTML files delivered through Cloudflare. No PHP runs on them, so there is no version to check or update.

The bottom line

Check your PHP version today, it takes a minute. If you are on 8.2 or older, plan the switch to 8.4 or 8.5 now: backup, update, test, switch. And if you would rather not repeat this every two years, a site without PHP removes the job entirely.

Sources: php.net, WordPress.org requirements, WordPress.org: update PHP, WordPress core team, IONOS, webgo, STRATO.

How to check and update your PHP version, safely