WooCommerce and PHP
WooCommerce PHP version requirements
WooCommerce asks for PHP 8.3 or greater, names 8.4 as the newest branch it has tested, and still runs on 7.4 for older setups. For a shop patched against PHP2Shell, that points to PHP 8.3.36 or 8.4.27 or later. WooCommerce 11.6, planned for February 2027, will need PHP 8.1 at least.
Last reviewed against WooCommerce's documentation, wordpress.org and php.net.
Requirements table
WooCommerce and WordPress requirements together
A WooCommerce shop has to satisfy two sets of rules at once: the plugin's and those of the WordPress installation it runs inside.
| Component | Minimum | Recommended or notes |
|---|---|---|
| WooCommerce 11.2.1 (current release, updated 9 October 2026) | PHP 7.4; WordPress 7.0 | PHP 8.3 or greater, tested up to PHP 8.4 |
| WooCommerce 11.3 to 11.5 | PHP 7.4 still accepted | From 11.3, a dismissible admin notice on stores running PHP 7.4 or 8.0 |
| WooCommerce 11.6 (planned for February 2027) | PHP 8.1 | Announced by the WooCommerce team on 29 September 2026 |
| WordPress 7.1 | PHP 7.4 | PHP 8.3 or greater recommended; works on 7.4 through 8.5 |
| Database | MySQL 5.6 or MariaDB 10.4 in legacy setups | MySQL 8.0 or MariaDB 10.6 or greater (WordPress itself recommends MariaDB 10.11 or greater) |
| Server | HTTPS support | A WordPress memory limit of 256 MB or more |
WooCommerce's server recommendations page is headed for 10.8 and later and gives WordPress 6.9 as the minimum; the wordpress.org listing for the current release, 11.2.1, asks for WordPress 7.0. The table uses the listing, since that is what the plugin itself declares.
Sources: WooCommerce server recommendations; WooCommerce on wordpress.org; WooCommerce 11.6 PHP announcement; WordPress requirements; WordPress PHP compatibility.
Each PHP branch, from a shop's point of view
| Branch | PHP2Shell fixed in | Where WooCommerce stands | For a shop |
|---|---|---|---|
| PHP 8.5 | 8.5.12 | Compatible with WordPress 7.1, but newer than WooCommerce's tested range | Wait until every extension you rely on names 8.5. |
| PHP 8.4 | 8.4.27 | The newest branch WooCommerce lists as tested | The strongest choice for most shops today. |
| PHP 8.3 | 8.3.36 | The lowest branch WooCommerce recommends | A safe target if an extension is not ready for 8.4. |
| PHP 8.2 | 8.2.35 | Runs, below WooCommerce's recommendation | Patch now, move up before 31 December 2026, when 8.2 reaches end of life. |
| PHP 8.1 | No release from the PHP project | Becomes WooCommerce's minimum from 11.6 | A minimum is not a target: this branch has no PHP2Shell release. |
| PHP 8.0 and 7.4 | No release from the PHP project | Legacy; admin notice from 11.3; WooCommerce updates stop at 11.5 | Move to 8.3 or 8.4 as a priority. |
Fixed releases are the PHP project's, from 21 October 2026. For the date each branch stops getting fixes, see PHP end of life; to compare WooCommerce with other platforms, see the requirements hub.
WooCommerce's PHP timeline
A new minimum is coming, and it is still not enough
On 29 September 2026 the WooCommerce team announced that WooCommerce 11.6, planned for February 2027, will require PHP 8.1 or newer, after moving the change back from 11.5 following community feedback.
That is a statement about WooCommerce's own code, and it runs to a different clock from PHP2Shell. PHP 8.1 got no fixed release from the PHP project and reached end of life on 31 December 2025. A shop that moves from 7.4 to 8.1 because of the WooCommerce notice would meet the new minimum and still be on a branch with no upstream fix.
- WooCommerce 11.3. Stores on PHP 7.4 or 8.0 start to see a notice in the admin. They can dismiss it, and everything keeps working.
- WooCommerce 11.5. The last release those stores can install while staying on 7.4 or 8.0.
- WooCommerce 11.6, February 2027. PHP 8.1 becomes the minimum. The WooCommerce team says the change will not deactivate an installation that is already running.
- Today. PHP2Shell is fixed only in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Skip the 8.1 stop and go to 8.3 or 8.4.
Extensions and gateways
Four things to check before the PHP switch
On a new PHP branch, the extensions around WooCommerce need as much attention as WooCommerce itself, above all the ones that take money.
Payment gateways
Each gateway is its own plugin, written and updated by its own developer, and it runs on every order. Find the newest PHP branch its developer supports in the changelog or support pages, and if a gateway has not been updated for a long time, treat that as the answer.
What extension headers do and do not say
WooCommerce extensions declare "WC requires at least" and "WC tested up to", but both refer to WooCommerce release series, not PHP. Woo's version support policy covers WordPress and WooCommerce versions only, so PHP compatibility has to come from the developer or from testing.
An inventory from the status report
WooCommerce, Status lists every active plugin with its version, the PHP version under Server Environment, and theme template overrides that have fallen out of date. Save a copy before the change: it becomes your list of things to test and your record of how the shop looked.
PHP extensions the shop leans on
WooCommerce's server recommendations mention cURL or fsockopen for integrations such as PayPal IPN, SOAP for some WooCommerce.com extensions, and Multibyte String for shops not in English. On many servers each PHP branch has its own set of extensions, so confirm every one is enabled on the new branch too.
Sources: Woo version support policy; WooCommerce system status report; WooCommerce server recommendations.
Step by step
Moving a WooCommerce shop to a new PHP branch
These are the shop-specific steps. Where to click in cPanel, Plesk or a managed host's dashboard is covered on how to update PHP in WordPress, and the server side on how to update PHP.
-
1. Save the system status report
In WooCommerce, Status, choose Get System Report and download or copy it. It records the PHP version, every active plugin and its version, and the server settings as they are now.
-
2. Choose 8.4 or 8.3
Pick 8.4 if your gateways and other extensions support it, 8.3 if one does not yet. Either way, use the fixed release or a later one on that branch.
-
3. Back up and make a staging copy
The WooCommerce team's own advice for the PHP 8.1 change is to make a backup and try the PHP change on a staging copy first. On the copy, put each gateway into test or sandbox mode if it has one, and stop outgoing customer emails if your setup allows it.
-
4. Switch the copy and walk the order path
Change the copy's PHP, then buy something as a guest and as a logged-in customer, with each payment method. Apply a coupon, check the shipping and tax totals, follow the order through to completed, and issue a refund. If you sell subscriptions, bookings or memberships, run their renewal or booking flow too.
-
5. Read the logs and the background tasks
WooCommerce, Status, Logs keeps fatal errors without any setup; payment gateway logs usually have to be switched on in the gateway's settings first. The Scheduled Actions tab shows background tasks that failed, with the error for each.
-
6. Switch the live shop when trade is slow
Choose the quietest hour you have, note the PHP version you are leaving, and keep the control panel open so you can switch back within minutes if checkout misbehaves.
If the fix is not in place yet
Why a shop cannot wait as long as a blog
PHP2Shell can give an attacker with no login control of the web server. On a WooCommerce shop that server renders the basket and checkout, and passes customers to the payment step. Even when a gateway collects card details on its own hosted page, the page that sends the customer there comes from your PHP.
Both vulnerabilities have been on CISA's Known Exploited Vulnerabilities catalogue since 26 October 2026.
- Get a date from your host. If the host manages PHP, ask for the fixed version and when it will be live; the WordPress guide has a message you can send.
- Apply the interim settings. They reduce the risk but do not remove it: the PHP project's interim settings.
- Decide whether to keep trading. CISA's advice covers both cases: offline if the system cannot be patched at once, or if it runs PHP 8.1 or earlier: should I take my website offline?
Confirm it worked
Check the shop, not just the server
A switch can succeed on the server and still leave the shop half working. Run these on the live site after the change.
The version
Open WooCommerce, Status and read PHP version under Server Environment. It should be 8.3.36, 8.4.27 or later on its branch. Other ways to check.
The report
Get a fresh system report and compare it with the one saved in step 1. Plugins that went missing, settings that changed and new template warnings all show up side by side.
A real order
Buy a low-value item through each live payment method, check the confirmation emails arrive, then refund it. Look at Scheduled Actions an hour later for anything failed.
The weeks before
Unfixed PHP facing the internet, even for a few days, is reason to look for planted files and altered checkout code: signs of compromise.
Restarting PHP and the other server-side checks are on confirm the update took effect.
Quick answers
WooCommerce PHP version questions
What PHP version does WooCommerce need?
WooCommerce asks for PHP 8.3 or greater and is tested up to PHP 8.4. The current release still declares PHP 7.4 as its minimum, which WooCommerce describes as end of life. For PHP2Shell, use 8.3.36 or 8.4.27 or a later release on those branches.
Can WooCommerce run on PHP 8.5?
WordPress 7.1 is compatible with PHP 8.5, but WooCommerce's server recommendations list testing only up to 8.4. A shop can move to 8.5 once WooCommerce and every extension it uses state support; until then, 8.4.27 or later is the stronger choice.
When will WooCommerce stop supporting PHP 7.4?
The WooCommerce team has announced that WooCommerce 11.6, planned for February 2027, will require PHP 8.1 or newer. From 11.3, stores on 7.4 or 8.0 see a dismissible admin notice, and they can keep updating up to 11.5. The change does not deactivate an existing installation.
Does updating WooCommerce change my PHP version?
No. WooCommerce is a plugin running on PHP; the PHP version is set by your host or whoever manages the server. Updating WooCommerce, WordPress or any extension leaves PHP exactly as it was.
Where do I see the PHP version in WooCommerce?
Go to WooCommerce, then Status. The PHP version appears in the Server Environment section of the system status report, next to the post size, time limit and max input vars settings. WordPress's Site Health screen shows it too.
Is my payment gateway compatible with PHP 8.4?
Only its developer can say for certain, so check the gateway's changelog or support pages, then prove it on a staging copy with the gateway in test or sandbox mode if it has one. A gateway that has not been updated for a long time is a reason to look for a maintained alternative before the switch.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.