On 31 December 2026, PHP 8.2 stops receiving security patches. After that date, any vulnerability found in it stays unfixed, permanently.
If your WordPress site runs PHP 8.2, you have roughly ten weeks. Nothing breaks on 1 January. The site keeps working. What changes is that you are now running software nobody will patch again, on a platform that is the most attacked in the world.
This guide covers how to check what you are on, which version to move to, and how to upgrade without taking the site down.
What end of life actually means
Three support stages, and most site owners have only heard of the first.
Active support. Bugs and security issues both get fixed. Roughly two years from release.
Security support. Only critical security issues get fixed. Roughly one further year.
End of life. Nothing gets fixed. The version is finished.
PHP 8.2 has been in security-only support since 31 December 2024. It reaches end of life on 31 December 2026.
The part most articles miss
The same date also ends active support for PHP 8.4, which drops to security-only.
So from 1 January 2027 the landscape looks like this:
| Version | Status from 1 Jan 2027 | Patched until |
|---|---|---|
| PHP 8.1 and below | End of life | Already unsupported |
| PHP 8.2 | End of life | Nothing further |
| PHP 8.3 | Security only | 31 Dec 2027 |
| PHP 8.4 | Security only | 31 Dec 2028 |
| PHP 8.5 | Active support | 31 Dec 2029 |
That matters for the upgrade decision. Moving from 8.2 to 8.3 buys you twelve months before you are back here. Moving to 8.4 buys two years. It is the same amount of work either way.
Check what you are running
Three ways, in order of ease.
WordPress admin. Tools, then Site Health, then the Info tab, then the Server section. It lists the PHP version.
Your hosting panel. cPanel, Plesk and most Singapore hosts have a “Select PHP version” or “PHP settings” screen showing the current version and the ones available.
A one-line file. Create phpinfo.php containing <?php phpinfo();, upload it, open it in a browser, and read the version at the top. Delete it immediately afterwards. Leaving it in place publishes your server configuration to anyone who guesses the filename, which is a real finding in security audits.
Which version to move to
WordPress itself recommends PHP 8.3 or greater.
For most Singapore business sites, the practical answer is PHP 8.4. It is supported until the end of 2028, it has been in the wild for two years so plugin compatibility is settled, and it is offered by essentially every host.
PHP 8.5 has active support until the end of 2027 and is the forward-looking choice, but it is younger. If you run a plugin-heavy site or anything with custom code, check compatibility before jumping there.
PHP 8.3 is the conservative option and is fine if your host does not yet offer 8.4. Just note you will be doing this again in a year.
What not to do: stay on 8.2 because it works. It will keep working right up until it does not, and the failure mode is a compromise rather than an error message.
Why this matters more for WordPress than for other software
WordPress runs a large share of the web, which makes its stack the most profitable thing to attack. Three specific consequences:
Plugins compound the exposure. Your PHP version is the floor under every plugin you run. An unpatched interpreter plus thirty plugins is a larger surface than the core software alone.
Attacks are automated. Nobody chooses your site. Bots scan for known vulnerabilities at scale, and an unpatched PHP version is exactly the signal they scan for.
Plugin authors drop support too. Once a PHP version is end of life, plugin and theme developers stop testing against it. You start encountering breakage caused by updates you did want.
There is also a performance argument. Each recent PHP release has been measurably faster than the last, and PHP execution is part of your server response time, which feeds into Core Web Vitals.
How to upgrade without breaking the site
The upgrade itself is usually a dropdown in your hosting panel. The work is what happens around it.
Before you touch anything
- Take a full backup. Files and database. Download a copy somewhere that is not the server. A backup that lives only on the host you are about to change is not a backup.
- Update WordPress core, plugins and themes. Most compatibility problems are caused by outdated plugins, not by PHP. Doing this first removes most of the risk.
- Remove what you do not use. Deactivated plugins still sit in the filesystem. Delete them. Fewer plugins, fewer compatibility surprises.
- Note your current version, so you know what to roll back to.
Test before you switch
Use a staging site. Most decent Singapore hosts provide one-click staging. Clone the site, change PHP there, and click through the important paths: a form submission, a checkout, the admin screens you actually use, anything custom.
If you have no staging environment, that is itself worth fixing. It is the difference between finding a problem in private and finding it in public.
Run a compatibility check. The PHP Compatibility Checker plugin scans your code for known incompatibilities. It produces false positives, so treat it as a list to investigate rather than a verdict.
Switch
- Change the PHP version in your hosting panel.
- Load the front page, then the admin.
- Click through the critical paths again on the live site.
- Check your error log for new warnings.
- Leave it a few days before declaring success, since some errors only appear on specific actions.
If something breaks
Switch back to the old version in the panel. The rollback is as quick as the upgrade.
Then identify the culprit: the error log usually names the file, which usually names the plugin. Either update it, replace it, or get the code fixed. Then try again.
Breakage is almost always a specific plugin or a piece of custom code written years ago, not WordPress itself.
If you are on PHP 7.x, this is more urgent
Some Singapore SME sites are still on PHP 7.4, which reached end of life in November 2022. That is four years without security patches.
If that is you, the PHP 8.2 deadline is not your problem. Your problem is that you have been running unpatched software for four years, and the upgrade is likely to break things because you are jumping several major versions at once. Budget for development time rather than treating it as a dropdown change.
A reasonable plan for the next ten weeks
| When | Do this |
|---|---|
| This week | Check your PHP version. Two minutes |
| This week | Confirm whether your host offers 8.4, and whether you have staging |
| Next two weeks | Update core, plugins and themes. Delete unused plugins |
| Weeks three to four | Clone to staging, switch PHP, test the critical paths |
| Weeks five to six | Fix or replace anything that breaks |
| Before December | Switch the live site, monitor for a week |
| Keep | A note of when 8.4 expires, so this is not a surprise in 2028 |
Leaving it to late December is the common mistake. Hosting support queues are slower over the holidays, and so are the plugin developers you may need.
Frequently asked questions
When does PHP 8.2 reach end of life?
31 December 2026. Active support ended on 31 December 2024, and security support ends on 31 December 2026. After that date no further security patches are issued for that branch.
What happens to my WordPress site when PHP 8.2 ends?
Nothing immediately. The site keeps running. What changes is that any vulnerability discovered afterwards will never be patched, which matters because attacks on WordPress are automated and specifically scan for unpatched versions.
Which PHP version should I upgrade to?
WordPress recommends PHP 8.3 or greater. For most business sites PHP 8.4 is the practical choice: supported until the end of 2028, with two years of real-world plugin compatibility behind it. PHP 8.5 has active support until the end of 2027 but is newer, so check your plugins first.
How do I check my PHP version in WordPress?
Go to Tools, then Site Health, then the Info tab, and open the Server section. Your hosting panel will also show it under PHP settings or Select PHP version.
Will upgrading PHP break my website?
It can, usually because of an outdated plugin or old custom code rather than WordPress itself. Update everything first, test on a staging site, and keep a full backup. If something breaks, switching back in your hosting panel is as quick as the upgrade was.
Is PHP 8.4 or 8.5 better for WordPress right now?
PHP 8.4 for most sites, because plugin compatibility is well established and it is patched until the end of 2028. PHP 8.5 is the better long-term choice and the only branch in active support from January 2027, but verify your plugins before moving to it.
I am still on PHP 7.4. How urgent is this?
Urgent. PHP 7.4 reached end of life in November 2022, so you have run without security patches for four years. Expect the upgrade to require development work rather than a simple version switch, since you are moving across several major versions.
Does the PHP version affect site speed?
Yes. Each recent release has been faster than the last, and PHP execution time is part of your server response. Upgrading usually improves server response time, which feeds into Core Web Vitals.
Do I need to do anything if my host manages updates?
Confirm it rather than assume it. Managed hosts vary: some upgrade PHP automatically, some notify you and wait, and some do nothing. Ask which applies to your plan and get the answer in writing.
If you would rather hand this over
The version switch is simple. The testing, the plugin compatibility work and the rollback plan are what take time, and they are the parts worth having done properly.
We handle PHP upgrades as part of website maintenance, including the staging test and the fix work when a plugin objects. For what that typically costs, see website maintenance cost in Singapore and what website maintenance covers.
If your host does not offer current PHP versions or staging, that is a hosting problem rather than a PHP problem. See how to choose the right web hosting.
