How to update PHP on a WordPress site
WordPress runs on PHP, but it doesn't control the PHP version; your host does. Six steps, about fifteen minutes, and a backup first.
Open Tools → Site Health → Info → Server to see your PHP version. If it is below 8.2.35, 8.3.36, 8.4.27, 8.5.12, update WordPress and its plugins, then switch the PHP version in your hosting control panel (the setting lives with the host, not in WordPress), then click through the site.
The steps
- Find the version you're on. In the WordPress dashboard go to Tools → Site Health → Info and open the Server section. “PHP version” is listed there. If it is below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, keep going.
- Take a backup. A PHP change is normally invisible, but on an old site a theme or plugin can object. Use your host's backup tool or a backup plugin, and confirm the backup exists before you touch anything.
- Update WordPress, the theme and every plugin first. Dashboard → Updates. Old plugins are the usual reason a PHP switch breaks something, and they are the next way in after PHP anyway.
- Switch the PHP version at your host. WordPress cannot change PHP itself; the host does. On cPanel hosting it's MultiPHP Manager; on GoDaddy Managed WordPress it's the site's Settings; on SiteGround it's Site Tools → Devs → PHP Manager; on Hostinger it's Advanced → PHP Configuration; on WP Engine and Kinsta it's in the site's environment settings. Pick the newest fixed release your host offers in your branch (or 8.3 / 8.4 if you are moving off an old branch).
- Click through the site. Home page, a post, the contact form, checkout if you sell online. If something shows an error, the usual culprit is one old plugin: deactivate plugins one at a time to find it, or switch PHP back and ask for help.
- Confirm. Site Health should now show the new version. If your host says the fix is applied but the version looks unchanged, that can be a backported fix; ask them to confirm in writing.
If you're on PHP 8.1 or older
There is no fix for those branches, so the move is to 8.3 or 8.4, the versions WordPress recommends (8.2 is patched too, but its security support ends on December 31, 2026). Nearly every WordPress site from the last few years runs on 8.2 and 8.3 without trouble. The exceptions are abandoned plugins and very old custom themes. The steps are the same; just expect to spend a little longer on step 5, and keep the backup handy.
If you can't do it
If you don't have the hosting login, the person who built the site is gone, or the switch breaks the site and you're not sure why, tell us. We'll confirm the version with your host, do the update, and sort out whatever objects.
Sources
- WordPress.org: the Site Health screen
- WordPress.org: hosting requirements (PHP 8.3 or newer recommended)
- PHP: supported versions and end-of-life dates
- NVD: CVE-2026-109618 and CVE-2026-109619
Common questions
Does updating WordPress update PHP?
No. WordPress, its plugins and its themes run on top of PHP, which your host installs and updates separately. Updating WordPress doesn't change the PHP version; you change it in your hosting control panel or ask your host.
Will changing the PHP version break my WordPress site?
Usually not, but an abandoned plugin or a very old theme can fail on a newer PHP. Take a backup first, switch, then click through the site; if something breaks, switch back and update or replace the plugin that failed.
Which PHP version should my WordPress site use?
WordPress recommends PHP 8.3 or newer. For PHP2Shell, the fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; anything older in those branches, and anything 8.1 or below, is affected.
Where do I see my PHP version in WordPress?
Go to Tools, then Site Health, then the Info tab, and open the Server section. It shows the exact PHP version the site is running.
Part of PHP2Shell: is your website affected, and what to do. Not sure which setup you have? Run the free PHP check and the result tells you.