Check your PHP version: is it supported and up to date?

What is PHP?

PHP is a programming language that runs on your web server. When someone visits a WordPress website, PHP builds each page on the fly, talks to the database and handles things like contact forms and shop checkouts. Visitors never see PHP directly, but almost every WordPress site depends on it.

PHP is installed by whoever manages your server. On most shared and managed hosting, that's your hosting provider, and they decide which versions are available.

Why does the PHP version matter?

Each PHP version (or "branch", such as 8.3) goes through three stages:

• Currently supported: receives bug fixes and security fixes. Two years from release.
• Security fixes only: receives fixes for important security problems only, for two further years.
• End of life: receives no fixes at all from the PHP project. New security problems stay unfixed upstream.

Within a branch, fixes arrive as patch releases (8.3.35, then 8.3.36, and so on). That's why the full version number matters: "PHP 8.3" on its own doesn't tell you whether the latest security fixes are installed.

PHP support dates

From PHP.net. Statuses are worked out from today's date.

How to find your PHP version

In WordPress

Go to Tools → Site Health → Info, open the Server section and look for PHP version. Full step-by-step guide with an illustration.

In your hosting control panel

• cPanel: look for "MultiPHP Manager" or "Select PHP Version" in the Software section.
• Plesk: open your domain and look for "PHP" or "PHP Settings", which shows the version in use.
• Other panels: search the panel for "PHP". If you can't find it, your host's support team can tell you.

Ask your host or developer

A quick message works: "Which PHP version is my website using, and is it receiving security updates?"

We don't recommend uploading a phpinfo() file to your website to check. It shows a lot of sensitive server detail publicly, and is easy to forget to delete.

What a version check can't tell you

Hosting providers and Linux distributions (such as Ubuntu, Debian, Red Hat and CloudLinux) often backport security fixes: they patch the PHP they ship without changing the main version number. Version numbers like 8.1.2-1ubuntu2.20 are a clue that this may be happening. We'll never declare a version vulnerable from its number alone. Instead we tell you what to confirm with your host.

And a supported, fully patched PHP version is a good sign, but it doesn't make a website secure on its own. Plugins, themes, passwords, backups and server configuration all matter.

Upgrading PHP safely

1. Take a full backup of your files and database (or confirm your host has a recent one).
2. Update WordPress, your theme and plugins first, since older ones may not support newer PHP.
3. If possible, test the new PHP version on a staging copy of your site.
4. Switch PHP version in your hosting panel (or ask your host), then check key pages, forms and checkout.

If you'd rather not do this yourself, Host Dada's managed WordPress hosting keeps PHP and backups looked after, and our development team can help with older sites that need work before an upgrade.