PHP Coding Computer CSS Data Digital Function Concept

Your website might look perfectly healthy, but that doesn’t necessarily mean it is secure. A growing number of WordPress websites are running outdated versions of PHP, leaving them exposed to security vulnerabilities and potentially putting their owners’ businesses at risk.

There has been considerable publicity recently about security vulnerabilities discovered in PHP, the programming language that powers WordPress and 70% of other sites on the World Wide Web.

The latest concerns, known as PHP2Shell, involve two critical vulnerabilities that could potentially allow attackers to execute malicious code remotely on affected servers. Security fixes have been released, and website owners and hosting providers need to ensure that their PHP installations are appropriately updated.

But this latest publicity highlights a much bigger problem: a surprisingly large proportion of WordPress websites are already running versions of PHP that are no longer supported.

How many WordPress websites are at risk?

PHP is regularly updated to correct errors, improve performance, and address security vulnerabilities. However, each version has a limited support period. Once a version reaches End of Life (EOL), the PHP development team no longer provides regular security updates or fixes for newly discovered vulnerabilities.

The problem is particularly evident among WordPress websites.

Recent WordPress usage statistics show that approximately:

• 15.1% of installations still use PHP 7.4.
• 1.3% use PHP 7.3.
• 1.3% use PHP 7.2.

Together, that’s approximately 18% of WordPress websites still running PHP 7.2, 7.3, or 7.4 — versions that have all passed their official support dates.

There is another significant figure. PHP 8.1, which also reached End of Life in December 2025, accounts for another 9.6% of installations and has also not received the security fix. The current fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. However, PHP 8.2 itself reaches End of Life on 31 December 2026, so it is not an ideal long-term destination for a new upgrade, and if that is your current version, this would be a good time to consider upgrading.

These statistics show that approximately 27% of WordPress websites are using one of these four unsupported PHP versions.

This is not a minor technical issue. It represents millions of websites potentially operating without the normal security protection provided by the PHP development team.

If one takes a number based on BuiltWith’s conservative track of 37.25 million live sites, 27% amounts to 10.06 million websites. Alternatively, if you take the broader WebPros Insights estimate of 100 million active sites, then 27% amounts to 27 million websites.

It is worth noting that some hosting providers may offer extended security support or backported fixes for older versions. However, website owners should not assume that this protection is included automatically.

Why are so many WordPress websites out of date?

There are several reasons why website owners allow their PHP versions to fall behind.

1. The website still works, so everything must be fine

WordPress and many hosting companies offer automatic updates for WordPress core, themes, and plugins, including a fallback in the event of a conflict that might otherwise cause a critical error and take a site offline.

This is convenient, but it can also create a false sense of security.

Many website owners simply check their live website from time to time. If the pages display correctly, the contact forms work, and everything appears normal, they assume that the website is up to date and protected.

Unfortunately, a website can continue functioning perfectly well while running outdated and unsupported software, until that vulnerability is exploited.

2. Automatic updates don’t include PHP

This is an important distinction.

Automatic WordPress updates do not change the PHP version running on the hosting server. PHP is a server-level setting, managed through the hosting account. There have been suggestions that hosting companies should automatically update PHP versions, but the problem with this is that hosts cannot determine what themes and plugins are in use on every site and whether these are compatible with an upgraded PHP Version.

Even when website owners know that their PHP version needs updating, many are understandably nervous about making changes to their server configuration.

Hosting companies sometimes display warnings that changing PHP versions could cause errors or affect website functionality. For someone without technical experience, this can be enough to discourage them from doing anything.

3. They have tried upgrading and encountered errors

Some owners may have already attempted to change their PHP version, only to find that their website develops errors or stops working correctly.

Without the technical knowledge to identify the cause, they may have simply reverted to the previous version and left the matter unresolved.

Unfortunately, this means the website remains exposed to the risks associated with outdated software.

Why can upgrading PHP cause website errors?

The most common reasons are outdated or unsupported WordPress plugins and themes or, rarely, WP core. WordPress generally accommodates outdated PHP in order to allow websites still using older versions to continue to display. From December 2026, the oldest supported version will be PHP 7.4, so any site using 7.2 or 7.3 will be unable to update WP core, or the site will likely cease working if that update is applied.

Although WordPress itself is regularly updated to support newer PHP versions, individual plugins and themes are developed and maintained by different developers and companies.

Most are regularly updated, but others may have been abandoned by their designers.

Over time, changes in PHP can make older programming code incompatible with newer versions.

Fortunately, resolving these problems is not always as difficult or expensive as website owners might expect.

Outdated plugins

In many cases, correcting plugin-related problems is relatively straightforward.

For example:

• A plugin may no longer be necessary because its functionality has since been incorporated into WordPress itself.
• An alternative, actively maintained plugin may provide the same functionality and be compatible with current PHP versions.
• An existing plugin may simply need updating or reconfiguring.

Once the underlying issue has been identified, replacing or correcting a plugin can often be a relatively simple task.

Outdated themes

Theme-related problems can be more complicated.

If a theme is no longer supported and contains code incompatible with newer PHP versions, replacing it may be the only sensible long-term solution.

The amount of work involved depends on the website’s design, structure, and complexity. A relatively simple website may be straightforward to recreate, while a more elaborate site with custom functionality, layouts and integrations could require considerably more work.

The important thing is not to assume that an incompatible theme means the website must be abandoned or rebuilt from scratch without first assessing the available options.

How to check whether your WordPress website is at risk

Fortunately, WordPress provides a built-in facility that makes it relatively easy to check which PHP version your website is using.

You don’t need to be a developer to carry out this initial check.

Step 1: Open Site Health

Log in to your WordPress Dashboard.

In the left-hand menu, scroll down to Tools and select Site Health.

Step 2: Check for a PHP warning

On the Site Health Status screen, WordPress may display a Critical Issue warning if your website is running an outdated PHP version.

If no such warning appears, you can check which PHP version your site is using.

Select the Info tab at the top of the Site Health screen, expand the Server section, and look for the PHP version.

This will show the PHP version currently being used by your website.

Step 3: Check whether an upgrade is required

Compare your version with the PHP versions currently receiving security support.

The official PHP website maintains an up-to-date list of supported versions:

https://www.php.net/supported-versions.php

Remember that a version being available in your hosting control panel does not necessarily mean it is still supported by the PHP development team.

How to change your PHP version

If your website is running an outdated version, you should contact your hosting provider or arrange for a suitable upgrade.

For those using cPanel, the process is usually as follows:

1. Log in to your hosting company account.
2. Open cPanel.
3. Scroll down to the Software section.
4. Select MultiPHP Manager.
5. Select the domain or website you want to update.
6. Choose the PHP version you wish to use and apply the change.

An important precaution: Before changing the version, make a note of the existing setting and confirm that you can switch back to it if problems occur. Ideally, take a complete website and database backup and test the change on a staging site first.

Do not simply select the newest version available without checking that your WordPress installation, plugins, and theme are compatible.

Also, remember that your hosting provider may offer different PHP versions and support arrangements. If you are unsure, ask their support team to confirm which supported versions are available.

There is a plugin, BrightLeaf Digital PHP Compatibility Scanner, that you can use to check compatibility, but be sure to understand the limitations.

PHP security is only part of the problem

Although the recent PHP vulnerabilities have attracted considerable attention, they are only one aspect of website security.

The increasing use of Artificial Intelligence is changing the cybersecurity landscape. AI can help malicious actors identify potential vulnerabilities, analyse software and develop attacks more quickly. WordPress websites are not immune.

Outdated or abandoned plugins and themes are particularly concerning because known vulnerabilities may remain uncorrected indefinitely.

Even WordPress core software, despite the extensive work undertaken by its development community, can potentially contain previously unknown vulnerabilities that may be discovered and exploited.

Keeping PHP up to date is therefore important, but it is not a substitute for maintaining the rest of your website.

A properly maintained WordPress website should have:

• WordPress core kept up to date.
• Plugins regularly updated and unnecessary plugins removed.
• A supported and maintained theme.
• PHP running on a supported version with the appropriate security patches.
• Regular security monitoring.
• Protection against malware and malicious file uploads.
• Measures to reduce the risk of cross-site scripting (XSS) and SQL injection.
• Regular backups and a recovery plan.

Security is not a one-off exercise. It requires ongoing attention.

Let Pixel Perfect Web Solutions take care of your website

As a business owner, your priority should be running your business, looking after customers and developing new opportunities — not worrying about whether your website is running outdated software or has become vulnerable to security threats.

That’s where Pixel Perfect Web Solutions can help.

We provide affordable, professionally managed website care and security services designed to keep WordPress websites updated, monitored and protected.

Our Managed Website service includes WordPress core, plugin and theme updates, PHP updates, security monitoring, database optimisation, Google Search Console reviews and priority support.

We also take website security seriously, with protection and monitoring designed to address threats including malware, malicious file uploads, cross-site scripting and SQL injection.

Is your website running an outdated version of PHP?

Pixel Perfect Web Solutions will carry out an initial website audit at no cost for website owners concerned about outdated PHP or other potential security issues.

We can assess your website, identify compatibility problems, and explain what needs to be done. If remedial work is required, we will provide a report and an estimate to explain any work that needs to be done to bring your site up to date and make it secure.

You don’t need to risk breaking your website by attempting an upgrade yourself.

Let us help you keep your website current, secure, and working as it should.

Visit our Managed Website Care and Priority Support page to see how we can help.

Pixel Perfect Web Solutions — keeping your website working, secure, and up to date so that you can concentrate on your business.