- Maintenance & security
PHP version update and website migration: a 2026 guide
Running an old PHP version quietly puts your website at risk. Here is what a PHP version update involves, why end-of-life versions are dangerous, and how a careful PHP website migration keeps your site fast and secure.
4 min read
A PHP version update is one of those maintenance jobs that is easy to postpone and expensive to ignore. PHP is the programming language behind a huge share of the web, including WordPress, Laravel, Magento and most custom business sites, so the version you run quietly decides how secure, fast and supportable your website is. This guide explains, in plain language, why old PHP versions are a problem in 2026, what a PHP version update actually changes, and how a careful PHP website migration keeps your site running without nasty surprises.
Why the PHP version matters
Every PHP version has a support window. For roughly two years it receives full fixes, then for a final year it receives security fixes only, and after that it reaches “end of life”, when the PHP team stops patching it completely. Once a version is end of life, newly discovered security holes in it are never fixed, however serious they are.
As of October 2026, PHP 8.1 and everything older is end of life and gets no fixes at all. PHP 8.2 receives security fixes only until 31 December 2026, and PHP 8.3 until 31 December 2027. The actively supported versions are PHP 8.4 and PHP 8.5. You can always check the current list on PHP's official supported versions page.
The security risk of old PHP versions
This is not theoretical. CVE-2024-4577 is a critical flaw, rated 9.8 out of 10, in the way PHP handled web requests on certain Windows setups. Attackers used it in the wild to take over servers, installing remote-access trojans, crypto-miners and ransomware, and the US Cybersecurity and Infrastructure Security Agency added it to its catalogue of actively exploited vulnerabilities. It was patched in PHP 8.3.8, 8.2.20 and 8.1.29.
The lesson is simple. Sites on a patched, supported version had a fix within days. Sites on an end-of-life version got nothing, and the hole stays open forever. Every month you run an unsupported version, the list of known, unpatched ways into your site gets longer. The business cost of leaving it shows up as:
- Hacked sites that serve spam or malware to your own customers, and get flagged by Google.
- Downtime and data loss while you clean up an incident instead of serving customers.
- Failed security questionnaires and PCI checks that block deals or card payments.
- Higher cyber-insurance premiums, or a claim refused because you ran unsupported software.
What a PHP version update actually changes
Moving up a PHP version is mostly good news. Each release is faster and uses less server memory, so the same hardware serves more visitors, and PHP 8 is dramatically quicker than the PHP 7 versions many older sites still run. On a busy site, that alone can lower your hosting bill.
The catch is that newer PHP is stricter. Code that “worked” on an old version by relying on sloppy behaviour can break: functions that were removed, warnings that are now errors, and assumptions about data types that no longer hold. How much work this is depends entirely on how your site was built and how far behind it has fallen.
How we run a PHP website migration
- Audit: we inventory your PHP version, framework, plugins and server, and scan the code for anything the target version removed or changed.
- Plan: you get a written plan with the target version, the work involved, a timeline and a fixed price, before anything starts.
- Staging: we upgrade a copy of your site first, never the live one, and test every important page and flow.
- Switch: we move the updated site across at a quiet time, with the old version kept ready in case we need to roll back.
- Check: we watch errors, speed and search rankings for a few days afterwards, and tune anything that needs it.
This is the same careful process we use for any website or platform work. If your site is more than a simple website, such as a booking system, a portal or a store, see our web application development service, or our website development service for a standard business site.
How to tell which PHP version you are on
Your developer or host can tell you in a minute, or you can look in your hosting control panel, which usually shows it. If the number starts with 7, or is 8.1 or lower, you are on an unsupported version and should plan an update now. If it is 8.2, you have until the end of 2026 before it stops getting security fixes.
The bottom line
A PHP version update is routine maintenance, not a rebuild, but left too long it turns into an emergency. Staying on a supported version, PHP 8.4 or 8.5 today, keeps your site patched, fast and cheaper to run, and keeps you off the list of easy targets. If you are not sure what you are on, or an update sounds daunting, tell us about your site and we'll check it and give you a clear plan.