Check which PHP branch the host runs, compare it with the official support dates, test the site on a supported branch on staging, then schedule the move. If the branch is past end of life, treat it as a security task, because it no longer receives fixes.
The PHP project publishes the rule. Each release branch gets two years of active support, then two more years of fixes for critical security issues only, then it reaches end of life and is unsupported.
What the support table says today
From the PHP supported versions page as fetched on 19 October 2026:
| Branch | Active support until | Security support until |
|---|---|---|
| 8.2 | 31 Dec 2024 | 31 Dec 2026 |
| 8.3 | 31 Dec 2025 | 31 Dec 2027 |
| 8.4 | 31 Dec 2026 | 31 Dec 2028 |
| 8.5 | 31 Dec 2027 | 31 Dec 2029 |
Branches older than 8.2 are not listed as supported. Dates change as releases ship, so re-check the page whenever you plan work.
Step by step
- Find the PHP version in the host control panel or with a status check in the CMS.
- Look it up in the table. Note when security support ends.
- List plugins and themes, and read each plugin's Requires PHP header. The WordPress plugin handbook describes this field as the minimum PHP version required.
- Clone the site to staging and switch the PHP version there.
- Click through key pages, forms, checkout and admin, and read error logs.
- Fix or replace what breaks. A plugin that fails on current PHP and has no update is itself a warning sign.
- Schedule the production change with a backup beforehand, and a rollback plan.
What to tell the client
Keep it short. "Your hosting runs a PHP version that stops getting security fixes on this date. We tested the site on a newer version and found these issues. We recommend moving by this date. Here is the work involved." Do not use alarmist language. State the date and the plan.
If the host will not upgrade
Some hosts keep old branches long after support ends. Ask whether a newer branch is available in the control panel. If not, the realistic option is to move host. The WordPress handbook lists qualities of a trusted host, including providing recent stable versions of server software and reliable backup methods, so use that as a checklist when choosing.
Make it routine
Add the PHP end date to your inventory and review it twice a year. A site that is two years from end of support is a planned job; a site that is a year past is an emergency.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are sorted and tracked to closure, which is the model for a PHP upgrade ticket.
For projects with a repository, Safeguard's free scan lists vulnerable dependencies alongside the version information.
Quick check
What does end of life mean for PHP?
The branch no longer receives fixes, including security fixes, from the PHP project.
Can a plugin block a PHP upgrade?
Yes. Check each plugin's Requires PHP value and test on staging before changing production.
Sources
Last reviewed: 19 October 2026.
