What PHP is, and why it expires

PHP is the programming language that runs on your web server and builds your pages each time someone visits. WordPress is written in it, and so is this site. The PHP project supports each version for about four years: two years of regular bug fixes, then two years of security fixes only. After that, newly found security holes are not fixed for that version.

  • PHP 8.1: security support ended December 31, 2025.
  • PHP 8.2: security support ends December 31, 2026.
  • PHP 8.3: supported until December 31, 2027.
  • PHP 8.4: supported until December 31, 2028.
  • PHP 8.5: the newest version, supported until December 31, 2029.

WordPress itself now recommends PHP 8.3 or newer.

Why your web host matters here

You do not install PHP yourself. Your web host runs it on the server, and that is one of the clearest differences between hosting levels. A good managed host warns you before a version expires, tests your site, and helps you move. A bargain host may leave old versions running for years, or put a version menu in your control panel and leave the rest to you. I explain the difference in managed vs shared hosting.

To be fair, some hosting platforms offer extended-support builds that keep patching older versions. So an old version number is not always unpatched. But you should know which situation you are in, rather than assuming.

How to check, and how to upgrade safely

To find your version, look in your hosting control panel. In cPanel it is usually under “MultiPHP Manager” or “Select PHP Version”. In WordPress, go to Tools, then Site Health, then Info, and open the Server section.

  1. Back up the whole site first, files and database. See website backups that actually work.
  2. Update everything else first: WordPress, themes and plugins. Old code is what usually breaks on a new PHP version.
  3. Test on a staging copy if your host offers one. If not, switch during a quiet time.
  4. Check the pages that earn you money: contact forms, booking and checkout.
  5. Switch back if something breaks. In most control panels it takes a minute. Then fix the cause.

Aim for PHP 8.3 or 8.4. A plugin that will not run on either has probably been abandoned, and that is a security problem of its own.

Three questions to ask your web person

If someone else looks after your site, ask: what PHP version are we on, when does it stop getting security fixes, and what is the plan? A clear answer is a good sign. “It’s fine, don’t worry about it” is not. Keeping PHP current is part of ordinary website maintenance after launch.

Sources