Which PHP version should WordPress use, and how do you update it safely?

What does PHP do in WordPress?

PHP is the programming language WordPress is written in. Every time someone opens a page, the server runs WordPress, your theme and your plugins in PHP to build that page. The PHP version is chosen by your host, separately from the WordPress version, and it decides which language features your plugins can use and whether security holes in PHP itself still get fixed.

Which PHP version should WordPress use in 2026?

PHP 8.3 is the safe choice for almost every WordPress site, and PHP 8.4 is the better one if your plugins and theme support it. That follows from two published facts:

• WordPress recommends PHP 8.3 or greater. Its requirements page says so, beside MySQL 8.0 or MariaDB 10.11 or greater.
• The PHP project fixes each version for four years. Two years of full support, then two years of security fixes only. After that, a new security hole in that version is never fixed by the PHP project.

So pick the newest version your site can run without errors, and plan the next move before its security fixes end. For most sites today that means:

• New site: PHP 8.4, after checking the plugins you plan to use.
• Existing site on 8.3: stay, and plan a move to 8.4 during 2027.
• Existing site on 8.2 or older: move to 8.3 or 8.4 now. On 8.2 you have until 31 December 2026.
• PHP 8.5: fine for WordPress itself, but only worth it once every plugin you rely on says it supports 8.5.

PHP 8.6 is in release candidates at the time of writing. Do not run a release candidate on a live site; wait for the final release and for your plugins to catch up.

When does each PHP version stop getting security fixes?

These dates come from the PHP project's own supported versions and end of life pages. A version past its last date gets no fixes at all from PHP.

One exception: Linux distributions such as Ubuntu, Debian and Red Hat, and CloudLinux on many shared hosts, ship their own builds of PHP and sometimes keep patching them after the PHP project stops. If your version number carries their mark (for example 8.1.2-1ubuntu2), ask your host whether it is still patched before you assume the worst.

How many WordPress sites run old PHP?

A lot. When the WordPress core team announced the end of support for PHP 7.2 and 7.3 in January 2026, it published the PHP versions WordPress sites were using at the time:

Add those up and about 47% of WordPress sites were on PHP 8.1 or older in January 2026, all past the end of security support. Another 27% were on PHP 8.2, which joins them on 31 December 2026. Unless they move, roughly three quarters of WordPress sites will be on a PHP version with no security support from the start of 2027.

What is the minimum PHP version for WordPress?

WordPress 7.0 and later need PHP 7.4 or higher. WordPress 7.0, released in May 2026, dropped PHP 7.2 and 7.3. WordPress.org still says WordPress works on PHP 7.4, but adds that such old versions have reached their end of life and may expose your site to security holes.

So the minimum is what WordPress will install on, not what is safe. A site on PHP 7.4 has had no security fixes from the PHP project since November 2022, and more plugins drop old PHP every month.

On compatibility, the core team described WordPress in January 2026 as fully compatible with PHP 8.0 to 8.3 and beta compatible with PHP 8.4 and 8.5. The Hosting Team's compatibility table lists PHP 8.2 to 8.5 as the supported versions at the release of WordPress 7.1 in August 2026.

How do you check which PHP version WordPress is using?

The quickest way is in wp-admin:

1. Go to Tools, then Site Health.
2. Open the Info tab.
3. Expand Server. The PHP version is listed there.

If the version is out of date, the Status tab also shows a critical issue headed "Your site is running an outdated version of PHP, which requires an update".

Two other ways, if you cannot reach wp-admin:

• Your hosting panel. cPanel, Plesk and most managed hosts show the PHP version on the page where you change it.
• The server. With SSH access, wp cli info shows the PHP binary and version WP-CLI uses, and php -v shows the command line PHP.

wp cli info
php -v

One thing catches people out: the PHP on the command line is not always the PHP that serves your website. Many servers run several versions side by side. Trust the version Site Health shows, because that is the one your visitors get.

Why should you update PHP?

• Security. Once a version's security support ends, holes found in PHP itself stay open unless your host patches them. WordPress.org says outdated versions may expose your site to security vulnerabilities, and Site Health files an outdated PHP version under security.
• Plugins and themes. Developers raise their minimum PHP version over time. WordPress will not install or activate a plugin whose Requires PHP line is higher than your server's PHP, so on old PHP you slowly lose access to updates, security fixes included.
• Speed. Each PHP release is built with performance in mind, and WordPress's own Site Health page says you may see a positive effect on your site's performance after an update.
• Your host's timetable. Hosts retire old versions too, and some move sites to a newer version on their own date rather than yours.

What can break when you update PHP?

WordPress core is rarely the problem. When a site breaks after a PHP update, the cause is almost always an old plugin or theme, and very often one that is no longer maintained. Each version jump changes something old code relied on:

A deprecation is a warning, not an error: the code still runs. A fatal error stops the page. Since WordPress 5.2, a fatal error caused by a plugin or theme usually shows the "There has been a critical error on this website" message and sends a recovery mode email to the site's admin address, so you can still sign in and switch the plugin off. Our guide to fixing the WordPress critical error walks through it, and the white screen of death guide covers the cases where nothing shows at all.

Plugins nobody updates are the biggest risk. If a plugin has had no release in two years, it is unlikely to have been tested on PHP 8.3 or 8.4. See our guide to finding and replacing abandoned WordPress plugins before you switch.

How do you update PHP for WordPress safely?

The whole job usually takes 15 to 30 minutes on a well-kept site. Do it in this order:

1. Check which PHP version the site runs now. Open Tools, then Site Health, then the Info tab, and expand the Server section to see the PHP version.
2. Back up the files and the database. Take a full backup you know how to restore, so you can go back if a plugin fails on the new version.
3. Update WordPress, plugins and themes first. Most compatibility fixes arrive in ordinary updates, so bring everything up to date on the current PHP version before you change it.
4. Check what each plugin and theme supports. Look at the Requires PHP line and the changelog of every plugin and theme, and replace any that are abandoned.
5. Switch the PHP version in your hosting panel. Choose PHP 8.3 or 8.4 in cPanel, Plesk or your host's own dashboard. WordPress cannot change PHP itself.
6. Test the site and read the error log. Open the home page, a few key pages, the contact form, checkout if you have one and wp-admin, then read the PHP error log for new fatal errors.
7. Keep watching for a few days. Leave the backup in place, watch for errors and switch back in the hosting panel if something breaks that you cannot fix quickly.

Check every plugin and theme before you switch

On WordPress.org, each plugin page lists "Requires PHP" (the lowest version it runs on) and "Tested up to" (the newest WordPress it was tested with). Neither tells you the newest PHP it supports, so also read the changelog for mentions of PHP 8.3 or 8.4. For premium plugins and themes, check the developer's site or ask them. Anything with no update in two years should be replaced before you change PHP, not after.

Can you test on a copy first?

If your host offers staging, switch PHP on the staging copy first and click through it. If not, update in a quiet hour, with the backup ready, and test straight away. On most hosts going back is a single setting, so the risk is minutes, not days.

Which version should you jump to?

You do not have to step through every version in between. Moving from 7.4 straight to 8.3 is normal, provided your plugins and theme support 8.3. The deprecations of 8.1 and 8.2 still apply, so expect more notices in the log the further you jump.

Where do you change the PHP version?

PHP is set on the server, so it is changed in your hosting account, never in WordPress. Where to look:

On shared hosting, the setting usually applies per domain, so one website can move while another stays. If you cannot find it, ask your host's support which versions they offer and when they plan to retire the old ones.

What should you do if the site breaks after a PHP update?

1. Switch back first. Pick the previous PHP version in the same place in your hosting panel. It usually takes effect within a minute, and your visitors get a working site while you look into it.
2. Find the cause. Read the PHP error log or the recovery mode email. The path in the fatal error names the plugin or theme folder that failed.
3. Update or replace that plugin or theme, then switch PHP again.
4. Restore the backup only if the database itself was changed in a way you cannot undo, which is rare for a PHP switch.

If the error log fills with deprecation notices but the site works, you do not need to switch back. They are warnings for the plugin's developer, not faults on your site. Check that WP_DEBUG_DISPLAY is off so they never print on the page.

How do you keep PHP up to date on many WordPress sites?

On one site, Site Health is enough. On twenty, it means signing into twenty dashboards to find out which ones are still on PHP 8.1, and remembering to look again before every end of support date. That is the job WPCentrify, the WordPress management tool, takes off your hands.

• Every website's PHP version on one screen. The Websites list has a PHP column, and each website's overview shows its PHP version beside its WordPress version, so you can see at a glance which sites need to move.
• An email before PHP goes out of support. Sentinel, WPCentrify's security monitoring, checks the PHP version of every website you connect. When a website's PHP is within six months of the end of its security support, it tells you, so the upgrade can be booked with the host rather than rushed. Once support has ended, it raises a high priority finding and sends the "PHP or WordPress out of support" email alert, which is on by default.
• No false alarms about patched builds. If a website runs a host or distribution build of PHP that may still be patched, Sentinel says so and suggests asking the host, rather than raising the alarm.
• Errors after the switch. Switch on the "New fatal PHP error" alert and WPCentrify emails you when PHP stops a page with an error the website has not shown before, which is how you find the one plugin that did not like the new version.
• A way back. Backups with one-click restore give you a restore point to return to if a change goes wrong.

To be clear about what it does not do: WPCentrify does not change the PHP version on your server. That stays with your host. It tells you which websites need it, and when, before anyone else notices.

Your PHP update checklist

• Current PHP version noted from Site Health
• A fresh backup you know how to restore
• WordPress, plugins and themes up to date
• Every plugin and theme checked for PHP 8.3 or 8.4 support, abandoned ones replaced
• PHP switched to 8.3 or 8.4 in the hosting panel
• Home page, key pages, forms, checkout and wp-admin tested
• PHP error log read for new fatal errors
• A reminder set before the new version's security support ends

Sources

• Supported versions, PHP
• Unsupported branches, PHP
• Requirements, WordPress.org
• Dropping support for PHP 7.2 and 7.3, Make WordPress Core, January 2026
• Compatibility, WordPress Hosting Team Handbook
• Site Health screen, WordPress documentation
• Backward incompatible changes in PHP 8.0, deprecations in 8.1 and deprecations in 8.2, PHP Manual
• wp cli info, WP-CLI Commands

All sources checked on 7 November 2026.