Run PHP 8.3 or newer, and prefer 8.4 or 8.5 if your plugins support them. WordPress recommends 8.3 or greater, PHP 8.4 and 8.5 are in active support, and PHP 8.2 reaches the end of security support on 31 December 2026. Older branches already receive no fixes.
What the official pages say
WordPress's requirements page recommends PHP 8.3 or greater and MariaDB 10.11 or MySQL 8.0 or greater. It adds that WordPress still runs on PHP 7.4 and above, but those versions have reached end of life and may expose your site to security vulnerabilities.
PHP gives each branch four years: two of active support, then two of security-only fixes. As of the supported versions page dated 18 October 2026:
| Branch | Active support until | Security support until | Status |
|---|---|---|---|
| 8.2 | 31 Dec 2024 | 31 Dec 2026 | Security fixes only |
| 8.3 | 31 Dec 2025 | 31 Dec 2027 | Security fixes only |
| 8.4 | 31 Dec 2026 | 31 Dec 2028 | Active support |
| 8.5 | 31 Dec 2027 | 31 Dec 2029 | Active support |
Anything older than 8.2 is end of life, so it gets no fixes at all.
What to run
If you are on 8.2, you have about two months of security support left. If you are on 8.3, you have until the end of 2027 but are already in security-only mode. If you are on 8.4 or 8.5 you are on a branch still receiving regular fixes.
The sensible target for a new or refreshed site is the newest branch your plugins and theme support. Compatibility is the real constraint, not hosting.
How to check what you run
The Site Health screen in the dashboard reports the PHP version. You can also check from the command line:
php -v
wp cli info
Run them in the same environment that serves the site, since a server can have several PHP versions installed.
How to move up safely
- List every plugin and theme and check what PHP version each declares support for. The plugin list command can show the
requires_phpfield. - Build a staging copy on the target version.
- Turn on error logging and click through key pages, forms, checkout and admin screens.
- Replace or patch anything that fails. A plugin that does not support current PHP is a candidate for replacement under any abandonment review.
- Back up, switch the production site, and monitor logs for a few days.
- Keep the old version available for a short rollback window if your host allows it.
What to tell a client
Say plainly that the PHP version is a dependency with an end date, and that moving costs less when scheduled than when forced. Put the date in your maintenance plan and set a reminder a quarter before it.
Remember the database engine has its own lifecycle. Check that too when you plan the move. Safeguard can scan a repository for dependency manifests and produce an SBOM, and there is a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how end of life components are tracked like any other finding with an owner and a date.
Quick check
Is PHP 7.4 still okay if WordPress runs on it?
No. WordPress says it runs but both PHP 7.4 and old MySQL are end of life and may expose your site to vulnerabilities.
When does PHP 8.2 stop receiving security fixes?
On 31 December 2026, per the PHP supported versions page.
Sources
Last reviewed: 19 October 2026.
