Home › Tech & Security

How to Update PHP in WordPress Without Breaking Your Site (2026 Guide)

By Abdullah · Published · Checked against official sources on October 28, 2026

If your WordPress dashboard says your site is running an outdated version of PHP, or your host just emailed you about it, this is the safe way to fix it. The facts below come from official sources (PHP.net, WordPress.org, cPanel and the hosting companies themselves), and where something is our own advice, we say so. The steps are written for cPanel, Hostinger, Bluehost and DreamHost.

The short answer

  • Pick PHP 8.4 for most sites. Use 8.3 if one of your plugins is not ready for 8.4. Do not stay on 8.2 or older.
  • Back up your files and database, update WordPress, your theme and your plugins, then switch the PHP version in your hosting panel.
  • Open your site, test the important pages, and go back to the old version straight away if something breaks.

Why you should update PHP now

PHP is the language WordPress runs on. Each PHP version gets security fixes for a fixed time, and after that it is "end of life". PHP.net says users of an end-of-life release "should upgrade as soon as possible, as they may be exposed to unpatched security vulnerabilities."

This is not a theory. In October 2026 two critical flaws nicknamed PHP2Shell hit PHP itself, and the official fixes shipped as regular releases only for the branches that were still supported. We explain it in our PHP2Shell guide for WordPress owners. Here is where each PHP branch stands, according to PHP.net on October 28, 2026:

PHP branchActive support endsSecurity fixes endWhat it means today
8.531 Dec 202731 Dec 2029Newest, fully supported
8.431 Dec 202631 Dec 2028Supported, a safe choice for most sites
8.331 Dec 202531 Dec 2027Security fixes only
8.231 Dec 202431 Dec 2026Security fixes end in about two months
8.1, 8.0, 7.4EndedEndedEnd of life, no normal fixes

The dates for 8.5, 8.4, 8.3 and 8.2 are from the PHP.net supported versions page. The WordPress hosting handbook also describes 7.4, 8.0 and 8.1 as end-of-life versions that WordPress supports "for backward compatibility only".

Which PHP version should you choose?

Here is what WordPress itself says:

Our advice: choose PHP 8.4. WordPress recommends it for new sites and it gets security fixes until the end of 2028. PHP 8.5 is the newest, but plugins and themes tend to catch up with a new version slowly. PHP 8.3 is a fine fallback until the end of 2027.

One warning: WordPress supporting a PHP version does not mean every plugin and theme supports it. That is why the steps below include testing.

Step 1: Check which PHP version you use now

In your WordPress dashboard, go to Tools → Site Health → Info and open the Server section. The official Site Health documentation describes this screen. If your PHP is too old, the Status tab also shows a critical issue saying your site is running an outdated version of PHP.

Step 2: Make a full backup

The WordPress handbook says a complete backup needs both your files (core, plugins, themes, uploads, wp-config.php and .htaccess) and your database. A file backup alone does not include your posts and settings.

This matters more than usual here, because on some hosts you cannot easily go back to an older PHP version (see the Hostinger note below).

Step 3: Update WordPress, your theme and your plugins

GoDaddy's official advice is the same order: back up first, then update WordPress, the theme and the plugins, and only then change PHP. Old plugins and themes are a common reason a site breaks on a newer PHP version.

If a plugin has not been updated by its developer for years, look for an alternative before you upgrade PHP. This part is our own advice, not an official rule.

Step 4: Test on a staging copy if you can

A staging site is a private copy of your website. Many hosts offer one with a single click. Change the PHP version on the copy first, and click through your site there.

The WordPress handbook shows how to write errors to a log file instead of showing them to visitors. Add these lines to wp-config.php on the staging site, above the line that says "That's all, stop editing":

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', 0 );

Errors are then saved in wp-content/debug.log. The handbook advises against using debug mode on live sites, so remove these lines when you finish testing.

Step 5: Switch the PHP version in your hosting panel

Every host has a slightly different screen. These are the steps from each company's own help pages.

cPanel (MultiPHP Manager)

  1. Open MultiPHP Manager in cPanel.
  2. Tick the box next to your domain.
  3. In the PHP Version menu, pick the version you want. Versions your host recommends carry a "Recommended" label.
  4. Click Apply.

The cPanel documentation adds two useful notes. If the version you need is missing, it is either not installed on the server or not available to your account, and only your host can add it. Choosing inherit means your domain follows the server default instead of a version you picked.

Hostinger (hPanel)

  1. Go to Websites and click Dashboard next to your site.
  2. Open PHP Configuration in the sidebar.
  3. Choose the PHP version and click Update.

Per Hostinger's help page, the version applies to every website on that hosting plan, versions below 8.2 can no longer be selected, and for existing sites you can upgrade but generally cannot downgrade, except in the same login session if a problem appears. Take your backup first.

Bluehost

  1. Sign in to the Bluehost portal and open Websites.
  2. Click Manage Site next to your site, then open the Settings tab.
  3. In the PHP Version section, click Change PHP Version, pick a version and click Apply.

These are the steps in Bluehost's article for its current Agency Hosting portal. Bluehost says PHP 7.3, 7.4, 8.0 and 8.1 are deprecated and that it currently supports PHP 8.2 and newer.

DreamHost

  1. Go to Manage Websites, click Manage on your domain and open the Settings tab.
  2. Next to PHP, click Manage and choose a version in the PHP Version section.
  3. Click Change PHP Version and, when asked, pick Revert to previous PHP version. DreamHost marks this as the recommended choice.
  4. Confirm. The change takes under five minutes.

According to DreamHost's guide, if your code is not compatible, the site goes back to the earlier version on its own, so you can fix the problem and try again. The domain must be fully hosted, and choosing an end-of-life version may add extended support charges.

Another host?

Look for a setting called "PHP Version" or "PHP Configuration" in your control panel, or ask support to change it for you.

Important: choosing a version in a panel only picks from what the server already has installed. After the PHP2Shell flaws, your host also has to be running a patched build, for example 8.4.27 or newer on the 8.4 branch. Ask them, and read how in our PHP2Shell guide.

Step 6: Check the site after the change

  1. Open Tools → Site Health → Info → Server and confirm the new PHP version.
  2. Visit your home page, a blog post, your contact form and your login page. On a shop, test the checkout too.
  3. Clear your cache plugin or host cache, then check again.
  4. Watch your site for a day or two in case an error only shows up on a certain page.

If your site breaks

Do not panic, and do not start deleting things. Go in this order:

  1. Go back to the old PHP version in the same panel, if your host allows it. This is usually the fastest fix.
  2. If you cannot go back (for example on Hostinger), ask support or restore the backup you made in Step 2.
  3. Once the site works again, find the cause on a staging copy using the debug log from Step 4. In almost every case it is one old plugin or theme. Update it, replace it, or remove it, then try the PHP update again.

A tool people recommend, and why we do not

The PHP Compatibility Checker plugin from WP Engine often comes up in guides. Its WordPress.org page says it is no longer actively maintained, was last tested with WordPress 6.4.13, reads your code instead of running it, and can give false alarms. Use it only as a hint, never as proof that your site is safe. A real test on staging is better.

Frequently asked questions

Will updating PHP delete my posts or settings?

No. PHP changes how the server runs your site's code, and your content stays in your database. The risk is that an old plugin or theme stops working and your site shows an error until you fix or roll back. That is why you take a backup first.

Is PHP 8.3 still okay to use?

Yes, for now. PHP.net lists security fixes for 8.3 until 31 December 2027. WordPress also names 8.3 as the minimum recommended version. PHP 8.4 simply gives you more time.

Does switching to a newer PHP fix the PHP2Shell flaws?

Not by itself. The fix is in specific patched releases (8.5.12, 8.4.27, 8.3.36 or 8.2.35 and newer), or in a host build that includes the fix. Ask your host to confirm. Our PHP2Shell guide has a message you can copy.

My host only offers old PHP versions. What now?

Ask them for 8.3 or 8.4 in writing. If they cannot offer one, you are running on borrowed time, and moving to a host that keeps its PHP current is worth the effort.

Quick checklist

Final thoughts

Updating PHP takes about ten minutes of clicking, but the preparation is what keeps your site safe. Do the backup, update your plugins, switch the version, and test. With PHP 8.2 losing security fixes on December 31, 2026, this is a good month to do it.

This guide is general information, not professional advice. Hosting panels change, so follow your host's own instructions if they differ from the steps above. Facts were checked against the sources below on October 28, 2026.

Sources