If you’ve seen a nudge in your dashboard about updating PHP, or you’re just wondering whether your site is falling behind, it’s worth taking seriously: running an outdated PHP version in WordPress quietly makes your site slower, less secure, and more likely to break with each passing month. PHP is the programming language WordPress is built on, and unlike WordPress itself, its version isn’t something most site owners ever think to check — which is exactly why so many sites are running on a version that stopped getting security fixes years ago. This guide shows you how to find out where you stand and what to do about it.
Why the PHP version matters more than people think
Three concrete reasons, and none of them are abstract:
- Security. Each PHP version is only supported with security fixes for a couple of years. Once it reaches “end of life,” newly discovered holes in it never get fixed. A site on an unsupported PHP version is sitting on known vulnerabilities that will never be fixed, no matter how diligent you are with WordPress and plugin updates.
- Speed. Newer PHP versions are dramatically faster at running the same code. Moving up a few versions can noticeably cut your page-generation time with zero other changes — free performance. It’s one of the levers we reach for first when looking at how to speed up WordPress.
- Compatibility. WordPress itself, themes, and plugins increasingly require a modern PHP version. Stay too far behind and updates start refusing to install — which pushes you toward the security problem all over again.
How to check what version you’re on
You don’t need any technical access to find out. WordPress tells you directly:
- Log into your dashboard and go to Tools, Site Health.
- Open the Info tab and expand the Server section.
- Look for “PHP version.” That’s your number.
The Site Health “Status” tab will also flag it outright if WordPress considers your version outdated or insecure. As a rough guide: if your number starts with anything below the versions currently marked as supported on php.net, you’re overdue. If you’re several major versions behind, treat it as urgent rather than someday.
Why so many sites get stuck on old PHP
It’s rarely a decision — it’s neglect by default. When a site was first built, it got whatever PHP version the host had set. Years pass, nobody changes it, and the host doesn’t force the issue because bumping a customer’s PHP version can break an old plugin and generate a support ticket. So the safe-for-the-host move is to leave you where you are, quietly aging, until something forces the question.
The other reason people put it off is fear — and it’s a fair fear. Upgrading PHP can break a site that relies on old, unmaintained code. But the answer to that is to upgrade carefully, not to never upgrade.
How to upgrade safely
The version number itself is a simple host-side setting; the care is all in doing it without surprises. The safe sequence:
- Back up first, so you have a clean copy to return to if anything misbehaves.
- Test on a copy, not live. Change the PHP version on a staging copy of the site and click through every important page and function — checkout, forms, logins — before touching production.
- Update plugins and your theme first. Most compatibility breaks come from outdated add-ons; current versions are far more likely to support modern PHP.
- Upgrade one major version at a time if you’re far behind, checking the site at each step, rather than making one giant leap.
- Watch for errors after the switch, and keep that backup handy.
Our step-by-step guide on how to change the PHP version in WordPress walks through the actual switch. And if the upgrade surfaces a memory complaint on the newer version, our guide to the PHP memory limit covers that too.
Don’t forget the security angle
An outdated PHP version is one of those weak points that doesn’t show up until it’s exploited. It belongs on the same list as weak passwords and out-of-date plugins — quiet gaps that make a site an easier target. If you’re auditing your site’s exposure, our WordPress security checklist puts PHP version alongside the other essentials worth locking down.
When the fix is really the host
Here’s the thing: on hosting that’s genuinely managed, you should never be the one worrying about your PHP version. Keeping the underlying software current — carefully, tested, without breaking your site — is precisely the sort of behind-the-scenes work that separates a platform that looks after your site from one that just rents you space and leaves the rest to you.
That’s how we run managed WordPress hosting. We keep sites on a modern, supported PHP version, and when it’s time to move up, every time we make a change we verify your site still looks and works right afterward — so you get the speed and security of current PHP without the risk of an upgrade quietly breaking something. There’s a real US-based team handling it, at the same predictable per-site price whether you run one site or a whole portfolio. Staying current is part of the care, not an upsell.
The short version
- Check your version under Tools, Site Health, Info, Server.
- If it’s below the currently supported versions, plan to upgrade.
- Back up, then test the new version on a staging copy.
- Update plugins and theme first; upgrade one major version at a time.
- Watch for errors and keep the backup ready.
If checking Site Health left you unsure, or the idea of upgrading PHP on a live business site makes you nervous, that’s a reasonable place to hand it off. Keeping your site on current, secure PHP without breaking it is routine work for our US-based team — and it’s the kind of thing that should just be handled, so it never lands on you at all.