WordPress depends on PHP, the server-side language that runs the site. If your hosting account uses an unsupported PHP branch, it may stop receiving fixes for newly found PHP bugs and security issues. That raises maintenance risk, but it does not prove that the website is infected or that PHP caused a specific outage.
As of 4 November 2026, PHP 8.1 has reached end of life, while PHP 8.2 remains supported only for security fixes through 31 December 2026. PHP 8.3, 8.4 and 8.5 have later security-support end dates. The official PHP support table and unsupported-branches page are the source of truth and should be checked again before publishing or reusing this article.
Which PHP versions are supported now?
PHP branches receive active support followed by a security-only period. After a branch reaches end of life, the PHP project no longer issues regular fixes for it. The current table lists PHP 8.2 through 8.5 as supported on the research date. PHP 8.2 is close to its final support date, so a site owner using it should plan ahead rather than assume it is already unsupported.
WordPress currently recommends PHP 8.3 or newer. Its requirements page notes that older PHP releases may still run WordPress in legacy setups, but being able to run is not the same as receiving upstream PHP security support. A site can be on supported WordPress core while its server runtime is past PHP end of life.
How do I check the PHP version on my site?
In WordPress Admin, open Tools → Site Health → Info → Server and look for the PHP version. Your hosting control panel may show a separate setting for the website's runtime. If the command-line version differs from the web server, ask the host which PHP version serves the public site.
Then check that branch against PHP's supported-version table. If the host applies vendor security backports, ask which package fixes are installed; a version label alone may not show every vendor change.
Can old PHP make a WordPress site break?
It can be a compatibility or security concern, but an outdated runtime is not automatically the cause of every white screen, 500 error or plugin failure. Moving to a newer PHP version can also expose old code in a theme, plugin, custom snippet or server extension. WordPress's PHP update guide recommends checking the runtime, making a backup, updating software and coordinating the change with the host.
Before switching PHP in production, make a restorable file-and-database backup, update WordPress core and extensions, and test the change on staging if possible. Check login, forms, checkout, scheduled jobs and API connections. If the site fails, capture the exact error and compare the failing component rather than changing PHP, core and plugins all at once.
PHP security updates are separate from WordPress updates. A recent Wordfence advisory on PHP vulnerabilities explains that updating WordPress does not patch the PHP service itself. Ask your host whether the PHP runtime has received the relevant fixes; do not assume that a WordPress dashboard update covered it.
If an old PHP version is blocking a business-critical site or the upgrade affects your team's wider technology, Engage24 IT Support describes its current email and workplace-device help. For website security monitoring and hardening, see Website Security.
Need help with an outdated PHP version?
Book time with Engage24 if you want help checking PHP support status or planning a tested upgrade for a WordPress site.