Security advisory: PHP released fixes for two critical flaws on 21 October 2026. Check whether your host has applied them.

Check your version

For WordPress and PHP site owners

PHP security alert. Is your site patched?

  1. What happened

    PHP, the language WordPress runs on, released fixes for two critical vulnerabilities on 21 October 2026. Supported branches need an updated patch release.

  2. What it means for you

    PHP 8.1 and older no longer get standard updates from the PHP project. Some hosts provide backported fixes, so check your exact patch status and plan an upgrade.

  3. How we help
    • We check your PHP version and ask your host about the security patches.
    • We upgrade a private copy first, so your live site stays up.
    • You get a fixed price before any work starts.
Book my free site check

A 30-minute call with a developer. You don't have to buy anything.

Not sure which PHP version you're on? Find out
A website in a glass browser window, shattering at one edge
Example audit
yourstore.com
PHP version
7.4.33 End of life
Last security fix
Nov 2022
Plugins blocking PHP 8
6 found
Move to
PHP 8.4 Patched
PHP 7.4: PHP project support ended Nov 2022 PHP 8.0: PHP project support ended Nov 2023 PHP 8.1: support ended Dec 31, 2025 PHP 8.2: support ends Dec 31, 2026 PHP 8.3: support ends Dec 31, 2027 PHP 8.4 and 8.5: fully supported

Why PHP upgrades stall

Old plugins, unclear code, and downtime worries keep sites on old PHP.

These are the five things WordPress owners tell us most, and what we do about each one.

  1. 01

    "We don't know which PHP version we're on."

    Your host set it up years ago and nobody has looked since. It's buried somewhere in a control panel.

    What we do

    We find it on the call in about two minutes, and show you where to look next time.

  2. 02

    "The last time we updated, the site broke."

    Older themes and plugins use code that PHP 8 removed. Switch versions on a live site and you can end up staring at a blank white page.

    What we do

    We copy your site to a private staging server and upgrade it there. Nobody touches your live site until the copy works.

  3. 03

    "The developer who built it is gone."

    Custom code with no notes. A premium theme that stopped getting updates. Plugins nobody remembers installing.

    What we do

    We read the code, fix what won't run on PHP 8 and swap abandoned plugins for maintained ones. You get a written list of every change.

  4. 04

    "We can't afford any downtime."

    Your site takes orders, bookings or leads. An afternoon offline costs money, and broken links can cost you Google rankings.

    What we do

    We switch over at your quietest hour and keep every URL the same. A full backup sits ready in case we need to roll back.

  5. 05

    "Our host says it's our problem."

    Most hosts will flip the PHP setting for you. They won't fix whatever breaks afterwards.

    What we do

    That part is our job. And if your host can't run current PHP, we'll move you to one that can.

Check your exposure

Which PHP version is your site on?

In your WordPress dashboard, go to Tools → Site Health → Info and open the Server section. Then pick the version you see.

See the 21 October PHP security advisory and official support dates. Some vendors backport fixes to older branches.

Pick a version above.

You'll see whether it still gets security fixes, and what to do next.

How the upgrade works

Four steps. Your site stays live for all of them.

  1. 1Day 1

    Free audit call

    30 minutes with a developer. We look at your PHP version, theme, plugins and hosting, then tell you what's likely to break.

  2. 2Days 2–5

    Upgrade on a copy

    We clone the site to a private staging server, switch it to current PHP and fix errors as they come up.

  3. 3Days 5–7

    You test it

    You click through the staging site and sign off. Nothing goes live until you're happy with it.

  4. 4Week 2

    Go live, then we watch

    We switch over at a quiet hour, keep a backup ready to roll back, and watch your error logs for two weeks.

Timings are for a typical WordPress site. A large WooCommerce store or a custom PHP app takes longer, and we'll tell you how long on the call.

Illustrative portrait of a developer in a creative studio Illustrative portrait of a developer at his workspace A senior developer on every call

Who you'll work with

You talk to the people doing the work.

Pixelable is a small studio of designers and PHP developers. A senior developer runs your audit call and stays on the project until it's live, so you always know who is touching your site.

We've spent years inside WordPress codebases that other people wrote. Old themes and odd plugins don't scare us.

Developer portraits are illustrative.

30mfree audit call with a developer
4clear steps from audit to launch
2wpost-launch monitoring

From clients

They were on old PHP too. Here's how it went.

We'd been stuck on PHP 7.4 for three years because our booking plugin broke every time we tried. Pixelable found the cause on the first call. Two weeks later we were on 8.3, and the site never went down.
Sarah MitchellOperations lead, Harbourline Stays 7.4 → 8.3
Our original developer disappeared in 2020 and left a pile of custom code behind. Pixelable went through all of it, fixed what was broken and wrote down what they changed. It's the first time I've understood how our own site works.
Daniel OkaforFounder, Okafor & Co. Accounting 7.3 → 8.4
I expected the upgrade to be painful. It was mostly boring, which is exactly what you want. Checkout feels quicker now, and our host has stopped emailing us security warnings.
Priya NairEcommerce manager, Lumen Ceramics 8.0 → 8.4

Free upgrade audit

Book 30 minutes. Leave with a plan.

Pick any open slot. On the call, a developer will:

  • Check your PHP and WordPress versions against the October 2026 advisory
  • Point out the plugins and theme code most likely to break on PHP 8
  • Give you a fixed price and a go-live date for the upgrade

The call is free. If you'd rather do the upgrade yourself, we'll tell you what to watch out for.

Can't find a time that works?

Send us your site and we'll email you what we find.

We use these details to reply to you. Read our privacy notice.

Open times load when you reach this section.

Or open the calendar in a new tab

Questions

Before you book.

Anything we haven't covered, ask us on the call. That's what it's for.

Book a free audit
Is my site affected?

Your PHP version alone cannot confirm that. PHP 8.1 and older no longer get standard updates from the PHP project, although some hosts provide backports. PHP 8.2 through 8.5 need their patched releases or a vendor-patched equivalent. Check the exact build with your host; the version checker above shows the branch's support status.

Will my site go down during the upgrade?

It shouldn't. We do the work on a staging copy, and switching to the upgraded site takes a few minutes at a quiet hour. We keep a full backup in case anything needs rolling back.

How much does it cost?

That depends on how many plugins and how much custom code need fixing. After the audit you get a fixed price in writing, so the number won't change halfway through. The audit is free.

Do we need a new host?

Usually not. Most hosts support current PHP. If yours doesn't, we'll suggest a couple of good options and handle the move.

Our site isn't WordPress. Can you still help?

Yes. We also upgrade custom PHP applications and other PHP platforms. The process is the same: audit, staging copy, your sign-off, then the switch.

Can we redesign at the same time?

You can. Some clients use the upgrade to rebuild on a faster theme or refresh the design. We'll quote both, so you can decide whether to do it now or later.

The patch exists. Make sure your site can get it.

Book the free 30-minute audit. We'll help check your host's PHP patch status and plan the next step.

Book a free audit