Is it dangerous to run an old PHP version?

Yes. Once a PHP branch reaches end of life, new security flaws in it are not fixed. Attackers scan the internet for servers announcing old PHP versions, so an outdated version is a common way in.

Will upgrading PHP break my website?

It can, if the theme or plugins are old. Back up first, update everything else, then switch PHP version at your host. Most sites move without trouble; the ones that break needed attention anyway.

How do I hide my PHP version?

Set expose_php = Off in php.ini, or ask your host to. That stops the X-Powered-By header announcing it. Hiding the version is good practice, but it is not a substitute for upgrading.

Does your check try to hack my site?

No. It reads only what any browser receives when it visits your home page, plus your public DNS records. It never tries to log in, never probes for hidden files and never sends attack code.

Security guide

Is your website’s PHP still getting security fixes?

Most small-business websites in the UK still run on PHP, usually underneath WordPress. When the PHP version reaches end of life, newly found flaws in it are never patched. The site keeps working, which is exactly why nobody notices.

Run the free security check

Which PHP versions are still supported

PHP gets two years of active support and then security-only fixes, after which the branch is retired. As of late 2026, these branches still receive security fixes:

PHP 8.2: security fixes until 31 December 2026
PHP 8.3: security fixes until 31 December 2027
PHP 8.4: security fixes until 31 December 2028
PHP 8.5: security fixes until 31 December 2029

PHP 8.1 was retired in January 2026, and everything older (8.0, 7.x, 5.x) has been unsupported for years. If your host still runs one of those, every PHP vulnerability published since then is open on your site.

Being on a supported branch is not enough on its own: you also need the latest patch release. The php2shell flaws disclosed on 21 October 2026 affect every branch until 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

How to find out which version you run

Your hosting control panel (cPanel, Plesk, or your host’s own dashboard) usually shows the PHP version per site, and most let you change it with a drop-down. WordPress also shows it under Tools → Site Health → Info → Server. Many servers also announce it to every visitor in an X-Powered-By header, which our free check reads.

PHP error messages on a live site

If you have ever seen text like “Warning: Undefined variable in /home/site/public_html/… on line 42” on your own pages, your server is set to display errors to the public. It tells anyone reading your folder layout, file names and sometimes database details, and it usually means something on the site is already broken. Errors should go to a log file that only you can read, not to the page.

Upgrading safely

Moving to a supported PHP version is normally a setting at your host, but old themes and plugins can break on newer PHP. Take a full backup first, try it on a staging copy if your host offers one, and update WordPress, the theme and every plugin before you switch. If something breaks, switch back, then fix the thing that broke rather than staying on the old version.

Questions people ask

Is it dangerous to run an old PHP version?: Yes. Once a PHP branch reaches end of life, new security flaws in it are not fixed. Attackers scan the internet for servers announcing old PHP versions, so an outdated version is a common way in.
Will upgrading PHP break my website?: It can, if the theme or plugins are old. Back up first, update everything else, then switch PHP version at your host. Most sites move without trouble; the ones that break needed attention anyway.
How do I hide my PHP version?: Set expose_php = Off in php.ini, or ask your host to. That stops the X-Powered-By header announcing it. Hiding the version is good practice, but it is not a substitute for upgrading.
Does your check try to hack my site?: No. It reads only what any browser receives when it visits your home page, plus your public DNS records. It never tries to log in, never probes for hidden files and never sends attack code.

Check your own site in thirty seconds

Our free, passive scan gives you a security score and grade, checks for the issues on this page, and keeps the details private. If you want them fixed, the Security fix package is a fixed price agreed up front.

Run the free security check About the Security fix