WordPress and PHP

How to update PHP in WordPress

WordPress runs on PHP but never updates it. Your web host sets the PHP version, usually through a control panel such as cPanel or Plesk. This guide covers finding your version, testing safely, making the change and proving the new version is live.

Last reviewed against php.net, wordpress.org and the cPanel, Plesk and WooCommerce documentation.

Which version

The best PHP version for WordPress in 2026

wordpress.org recommends PHP 8.3 or greater, and WordPress 7.1 works with every branch from 7.4 to 8.5. For security, the release matters as much as the branch: whichever branch you choose, it needs the release that fixed PHP2Shell on 21 October 2026, or a later one.

Branch PHP2Shell fixed in PHP security support until WordPress 7.1 Verdict
PHP 8.5 8.5.12 31 December 2029 Compatible The newest branch. Choose it when your theme and every plugin support it.
PHP 8.4 8.4.27 31 December 2028 Compatible A sound default, and the newest branch WooCommerce lists as tested.
PHP 8.3 8.3.36 31 December 2027 Compatible The lowest branch wordpress.org recommends.
PHP 8.2 8.2.35 31 December 2026 Compatible Patch to 8.2.35 now, then move up before the end of the year.
PHP 8.1, 8.0, 7.4 No release from the PHP project Ended Runs, but the branch is end of life Move to a supported branch as a priority.
PHP 7.3 and older None Ended Not supported since WordPress 7.0 WordPress itself no longer runs here.

Sources: wordpress.org requirements, the WordPress core team's PHP compatibility table, php.net's supported versions and the PHP project's 21 October 2026 security releases. Dates for every branch, including the retired ones, are on the PHP end of life page.

Step 1

Find the PHP version your site runs now

In WordPress, go to Tools, then Site Health, open the Info tab and expand the Server section. The PHP version line is the one you need.

If the version is below what WordPress recommends, you may already have seen a "PHP Update Required" or "PHP Update Recommended" notice on the dashboard or in Site Health. Your hosting control panel shows the version too: cPanel's MultiPHP Manager lists it beside each domain, and Plesk shows it next to the PHP icon on the domain's card.

Other ways to check your PHP version

Reading the number

  • The first two parts are the branch. In 8.3.36, the branch is 8.3.
  • The last part is the release on that branch. 8.3.36 is fixed for PHP2Shell; 8.3.30 is the right branch but an unfixed release.
  • A control panel may show only the branch. If your control panel says "PHP 8.3" with no final number, use Site Health for the full version.
  • An older-looking number is not always unfixed. Linux distribution packages often carry the fix without changing the number. If your host says so, ask which package includes it, or read how backported versions work.

Step 2

Test before you switch branches

A PHP change comes in one of two sizes. A newer release on the same branch, such as 8.3.30 to 8.3.36, carries bug and security fixes only, and on a hosting account the host installs it. A move between branches, such as 8.1 to 8.3, is where themes and plugins can break, so that is the change to test.

Do not let testing for a branch move delay the PHP2Shell fix. If your branch is still supported, get the fixed release on it first and plan the branch move afterwards.

  1. 3D secure vault with a green tick, for a backup you can restore

    Check 1

    Take a backup you can restore

    Back up the files and the database, and write down the PHP version you run today. Restoring an old backup can mean putting the old PHP version back as well, which may need your host's help.

  2. 3D server and monitor downloading updates, for updating WordPress, themes and plugins

    Check 2

    Update WordPress, the theme and plugins first

    Run everything waiting under Dashboard, Updates, then check the site still behaves. That way you test the newest plugin code against the new PHP, not an old release.

  3. 3D network of test and live machines, for trying PHP on a staging copy

    Check 3

    Try the new version on a staging copy

    If your host offers a staging site, switch the copy to the new PHP version before touching the live site. Leave the live site alone until the copy passes.

  4. 3D clipboard under a magnifying glass, for checking each plugin and theme

    Check 4

    Check each plugin and theme

    The Requires PHP line on a plugin's wordpress.org page is the lowest version it accepts, not the highest it has been tested on, so it will not warn you about a jump upwards. Read the changelog or ask the developer, and replace plugins nobody maintains.

  5. 3D laptop on a desk, for walking through the pages that matter

    Check 5

    Walk through what matters

    Log in, edit and publish a post, submit every form, and on a shop place a test order. Watch for blank pages, error messages and anything that looks different.

  6. 3D planner with a clock and calendar, for switching at a quiet time

    Check 6

    Switch the live site at a quiet time

    Note the version you are leaving so you can switch straight back from the same screen if something goes wrong.

wordpress.org's own guide to updating PHP sets out the same groundwork: back up, update everything, then check compatibility before the switch.

Step 3

Change the PHP version in your hosting control panel

Which screen you use depends on your host. The steps below cover cPanel and Plesk, then managed WordPress hosting, which usually has a dashboard of its own.

3D network of laptops and servers, for cPanel's MultiPHP Manager

cPanel: MultiPHP Manager

  1. Log in to cPanel and open MultiPHP Manager, in the Software section.
  2. Tick the box next to your WordPress site's domain.
  3. Pick the new version from the PHP Version menu. Your host may label some versions as Recommended.
  4. Select Apply.

A version missing from the menu is either not installed on the server or not offered to your account, and only the host can add it. A domain set to inherit follows the server's default. Hosts can switch this screen off; if you cannot find it, your host controls PHP.

Choosing a branch here runs whichever build of that branch the host has installed, so the host still has to install the fixed release.

Source: cPanel documentation

3D server rack, for Plesk's PHP settings

Plesk: the domain's PHP settings

  1. Log in to Plesk and go to Websites & Domains.
  2. Find your site's domain and select PHP.
  3. Make sure PHP support is ticked, then choose the version from the drop-down list. Leave the handler as it is unless you know you need another.
  4. Select OK. Plesk applies the change shortly afterwards.

The version in use appears next to the PHP icon on the domain's card. Your subscription may limit what you can change here, and if the version you want is not in the list, your host has to provide it.

Source: Plesk Obsidian documentation

3D cloud hosting servers with a shield, for managed WordPress hosting

Managed WordPress hosting

Hosts that sell managed WordPress usually give you their own dashboard instead of cPanel or Plesk. Look in the site's settings for a PHP version or PHP engine option, which is often set per site.

wordpress.org's Update PHP page links to hosts that have published their own instructions. If you find no setting at all, the host manages PHP for you: use the message further down this page.

Running your own server rather than a hosting account? The steps are different: how to update PHP on a server and on Linux.

Step 4

Confirm the new version is live

A setting saved in a control panel is not proof. Check what the site is actually running.

  • Reload Site Health. Tools, Site Health, Info, Server. Site Health reports the PHP that served the page you are looking at, so a new number there means your site is running it.
  • Compare the full number with the fixed release. 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later on the same branch.
  • Use the site as a visitor would. Browse the main pages, submit a form and check the admin screens you rely on. On a shop, run an order through.
  • If something breaks, switch back. Return to the previous version in the same panel, then fix the theme or plugin on your staging copy before trying again.
  • If the host updated PHP and the old number remains, the old PHP processes may still be running. Ask the host to restart them; an update that is installed but not loaded does not protect the site.
3D card payment terminal with coins, for WooCommerce shops

WooCommerce

Updating PHP under a WooCommerce shop

WooCommerce's server recommendations ask for PHP 8.3 or greater and list testing up to PHP 8.4. It still runs on versions as old as 7.4, which WooCommerce itself flags as end of life.

To see the version from inside the shop, go to WooCommerce, then Status: PHP version sits in the Server Environment part of the system status report.

If the shop is already on 8.3 or 8.4, the urgent job is the fixed release on that branch. A move to 8.5 can wait until your extensions say they support it.

WooCommerce PHP requirements in full

Source: WooCommerce server recommendations

What to test on a shop

  • Payment gateways first. Check each gateway extension's stated PHP support before the switch; a broken checkout costs more than a broken blog page.
  • A complete order on staging. Put the gateway in its test or sandbox mode and go from basket to confirmation email, including a refund if you issue them.
  • Shipping, tax, subscription and booking extensions. These also run during checkout, so test them alongside the gateway.
  • The risk while you wait. A site that takes payments is a more attractive target. If the fix is days away, the risk calculator helps you decide whether the shop should stay open meanwhile.
3D cloud with a secure core, for sites whose host manages PHP

My host manages PHP

If your host manages PHP for you

On shared and managed hosting, the host decides which PHP builds are available and when they are updated. When the PHP2Shell fixes shipped, wordpress.org noted that hosts might already be updating PHP and adding firewall rules, but still asked site owners to check with their host. Copy the message below, fill in the two gaps and send it to your host's support team.

Message to your host

Subject: PHP version on [your domain] and the 21 October 2026 PHP security fixes

Hello,

Please could you confirm the following for [your domain]:

1. The exact PHP version the site runs, including the final number (for example 8.3.36).

2. Whether that PHP build includes the fixes for CVE-2026-109618 and CVE-2026-109619, which the PHP project released on 21 October 2026. If your build carries the fixes as a backport under an older-looking version number, please tell me the package version that includes them.

3. If the site is on PHP 8.1 or older, what you plan to do and by what date, and which newer PHP versions I can move it to.

A written reply I can keep on file would be very helpful.

Many thanks,
[Your name]

What a useful reply contains

  • A full version number at or above the fixed release for its branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  • Or the name and version of a package that carries the fixes under an older-looking number.
  • Or, if neither is true yet, a date. A reply with no version and no date is not an answer.

If the reply leaves your site unfixed for more than a few days, work through the risk calculator. A server that ran a vulnerable build on the internet is also worth checking for signs of compromise: what to look for.

Quick answers

WordPress and PHP questions, answered

Does WordPress update PHP for me?

No. WordPress core, theme and plugin updates replace WordPress's own code, including the auto-updates WordPress runs in the background. PHP is the language runtime installed on the server beneath WordPress, and only your host, or whoever runs the server, can change it.

wordpress.org made the same point when the PHP2Shell fixes shipped: the flaws are in PHP, not WordPress, and no WordPress release was needed or planned for them.

What is the best PHP version for WordPress in 2026?

wordpress.org recommends PHP 8.3 or greater, and WordPress 7.1 is compatible with every branch from 7.4 to 8.5. In practice, choose 8.3, 8.4 or 8.5, whichever is the highest your theme and plugins support, at the latest release on that branch: 8.3.36, 8.4.27, 8.5.12 or later.

Avoid moving to 8.2 now. It is fixed for PHP2Shell in 8.2.35, but the PHP project stops supporting it on 31 December 2026.

Is PHP2Shell the same as the WordPress Click2Shell flaw?

No. Click2Shell is a separate WordPress vulnerability, fixed in WordPress 7.1.1 in September 2026. Another WordPress flaw, CVE-2026-87902, was fixed in WordPress 7.1.2 a few days later. PHP2Shell is in PHP itself, beneath WordPress.

A WordPress site needs both kinds of fix: WordPress kept current (7.1.3 was the latest release when this page was reviewed), and a PHP build that includes the 21 October 2026 fixes.

PHP2Shell explained

My site is on PHP 8.1 or older. What should I do?

Treat it as urgent. The PHP project published no fixed release for 8.1 or older, and CISA's guidance is to take PHP systems offline if they run PHP 8.1 or earlier, or cannot be updated immediately. wordpress.org told site owners who run their own hosting on these versions to consider taking the server offline while they prepare the update.

Ask your host which supported branch it can move you to, test on a staging copy, and switch as soon as the copy works.

Should I take my website offline?

Will changing the PHP version break my site?

It can, if a theme or plugin relies on something a newer PHP branch has changed or removed. That is why the staging test comes first. If the live site does break, switch back to the previous version from the same control panel screen, then fix the problem on the copy.

Can I change PHP from the WordPress dashboard?

No. The dashboard shows which version you run, under Tools, Site Health, and warns when it is out of date, but the change itself happens in your hosting control panel or is made by your host.

3D rocket illustration above the call to find every exposed PHP server

Know your exposure

Find every PHP server you run

Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.

Find Every Exposed PHP Server Book a Free Consultation