You keep WordPress up to date.
Plugins are up to date.
The theme is up to date.
So the website must be technically up to date too, right?
Not necessarily.
But underneath WordPress there’s another layer that most business owners rarely see:
PHP.
PHP is part of the server environment that WordPress runs on. And just like WordPress and plugins, PHP is continuously updated with bug fixes, improvements, and security patches.
That’s why it’s worth knowing which PHP version your website uses—even if you never work directly with PHP yourself.
What is PHP?
PHP is the programming language that a large part of WordPress is built with.
When a visitor opens a WordPress page, PHP helps fetch information from the database, process it, and build the page that’s sent to the browser.
You don’t need to know how to code in PHP to have a WordPress website.
But WordPress depends on PHP working correctly on the server.
Put simply:
WordPress is the website you work in.
PHP is part of the engine underneath it.
Why does the PHP version matter?
PHP is continuously developed.
Newer versions can include, among other things:
- security patches
- bug fixes
- performance improvements
- new features
- changes that modern software expects
Old PHP versions eventually stop being maintained.
When a version reaches end of life, the PHP project no longer releases security patches for it.
That doesn’t mean the website stops working from one day to the next.
But it will keep running on software where new security issues are no longer fixed.
October 2026 made it very clear why this matters
In October 2026, the PHP project released an extraordinary security update after two critical vulnerabilities were found.
In certain server configurations, they could allow an attacker to run code without first being logged in.
What was interesting for WordPress site owners was that the issue wasn’t in WordPress.
So there wasn’t a WordPress update that could fix it either.
It was PHP on the server that needed to be updated.
It’s a good example of why it’s not enough to only keep an eye on the WordPress dashboard.
An up-to-date WordPress site can still be using old PHP
Yes.
You can easily have:
- the latest WordPress version
- up-to-date plugins
- an up-to-date theme
and still be running an old PHP version on the server.
PHP is usually managed through your hosting environment—not through the regular WordPress updates screen.
That’s why it’s often the hosting provider or the person managing the website who keeps an eye on that part.
See also: Should You Update WordPress? Here’s Why You Shouldn’t Ignore Updates
How do you see which PHP version WordPress is using?
You can actually see it directly in WordPress.
Go to:
Tools → Site Health → Info → Server
Here you can, among other things, see which PHP version the website is running.
You can usually also find the information in your hosting provider’s control panel.
The most important thing isn’t necessarily that you can assess all the version numbers yourself.
But if the website is running a very old version, it’s worth looking into why.
So should you just choose the latest PHP version?
Not necessarily.
It’s much the same principle as with WordPress updates.
Newer is good—but changes should still be made in a controlled way.
An old plugin, a theme, or custom code may depend on functions that have changed in a newer PHP version.
If you just switch PHP versions without checking compatibility, the result can be errors—or, in the worst case, a website that no longer works properly.
That’s why I would usually:
- make sure there’s a usable backup
- check WordPress, theme, and plugins
- update what’s necessary first
- switch PHP version
- test the website’s most important functions afterwards
On a webshop or other more complex solution, the testing should of course be more thorough.
Old plugins can also hold PHP back
Sometimes the PHP version isn’t old because someone forgot about it.
It’s old because the website can’t be updated without issues.
An old plugin or theme may not run on a newer PHP version.
Then you get the classic situation:
PHP should be updated.
But something on the website breaks if you do.
That’s not a good argument for staying on old PHP forever.
It’s more a sign that the part of the website blocking the update should be investigated.
What does PHP 8.2 mean right now?
PHP versions have a limited support period.
At the time of this article, PHP 8.2 only receives security patches and reaches end of life on 31 December 2026.
PHP 8.3, 8.4, and 8.5 have longer support remaining.
That doesn’t mean all websites necessarily need to jump straight to the highest version on the same day.
But it does mean that websites on PHP 8.2 should have a plan to move on to a supported version.
Hosting plays an important role
PHP is one of the reasons hosting isn’t just about disk space.
Among other things, the hosting environment needs to keep the server software up to date and make it possible to use supported PHP versions.
In the case of critical security issues, the hosting provider may also be the party that needs to respond first.
That’s why it’s worth knowing:
- who manages the server
- who keeps PHP up to date
- how security updates are handled
- whether backups exist
- who responds if something goes wrong
Also read: What is web hosting—and why does it matter?
You don’t need to follow all PHP news
If you run a business, it’s hardly realistic that you should follow every single PHP release and security announcement yourself.
And you shouldn’t have to.
But someone needs to be responsible.
That could be the hosting provider, your web partner, or the person in charge of technical operations.
What matters is that PHP doesn’t get forgotten just because it isn’t visible in day-to-day use of the website.
WordPress is more than what you see in the dashboard
A well-functioning WordPress website consists of several layers.
WordPress.
Plugins.
Theme.
Database.
PHP.
Hosting.
Backups.
Security.
When all parts are kept reasonably up to date, the website becomes both easier to maintain and less vulnerable over time.
So the next time the WordPress dashboard says:
“Everything is up to date.”
it’s worth remembering that it doesn’t necessarily tell the whole story.
