PHP version security support warning
The GuardPress Pro vulnerability scan checks whether the PHP version your server runs still receives security fixes from the PHP project. This page explains what the warning means, when each PHP branch stops getting fixes, and how to move your site to a supported version.
What the warning means
The PHP project supports each release branch for a set time: first with bug and security fixes, then with security fixes only. After the security support end date, the branch gets no more fixes at all. GuardPress compares your server’s PHP branch with those dates and adds a finding to the vulnerability scan when it matters:
- Critical: your PHP branch no longer receives security fixes. The finding says so and names the version to move to.
- Medium: your PHP branch stops receiving security fixes within the next 90 days. The finding gives the end date so you can plan the move with your host.
Nothing is reported while your branch has more than 90 days of support left. The recommended version in the finding is the oldest PHP branch that still has more than a year of security support remaining; any newer supported branch is fine too.
Security support end dates by PHP branch
| PHP branch | Security fixes end |
|---|---|
| 7.4 | Ended |
| 8.0 | Ended |
| 8.1 | Ended |
| 8.2 | 31 December 2026 |
| 8.3 | 31 December 2027 |
| 8.4 | 31 December 2028 |
| 8.5 | 31 December 2029 |
Dates follow the PHP project’s published support schedule. Branches older than 7.4 have been out of support for years and are reported as critical too.
Why the version number can look old on a patched server
Many hosts and Linux distributions keep shipping an older PHP branch and backport security fixes into it without changing the version number. A server can report something like 8.1.2 and still carry fixes released much later, so the patch number on its own says little about whether the server is protected.
That is why GuardPress judges by branch (for example 8.1), not by patch number. It never warns because the last digit looks low. It warns only when the branch itself has passed, or is about to pass, the PHP project’s security support date.
If your host confirms they keep patching your branch beyond that date, the warning is a reminder to plan the upgrade rather than proof of a problem. Moving to a branch the PHP project still supports is still the safer long-term choice, because plugin and theme authors test against those branches.
How to change your PHP version
Most hosts let you pick the PHP version per site from their control panel. Menu names change from time to time, so if you can’t find the option, search your host’s help center for “change PHP version” or ask their support team to do it for you.
- cPanel: open MultiPHP Manager (in the Software section), tick your domain, choose the PHP version and apply.
- Plesk: go to Websites & Domains, open your domain’s PHP settings, select the PHP version and save.
- SiteGround: in Site Tools, go to Devs > PHP Manager and change the version for the site.
- Kinsta: in MyKinsta, open the site, go to Tools and change the PHP engine.
- WP Engine: in the User Portal, open the environment and change its PHP version.
- VPS or your own server: install the newer PHP branch with your operating system’s package manager, point the web server’s PHP handler (PHP-FPM pool) at it, and keep the same PHP extensions enabled.
Other managed hosts have an equivalent setting, and on hosts without one, a support ticket asking to move the site to the recommended PHP version is usually all it takes.
Test the site after switching
Back up or use staging first
Take a fresh backup, or make the change on a staging copy if your host offers one, so you can roll back quickly.
Switch the PHP version
Use the steps for your host above. Keep a note of the version you started on.
Check the important pages
Load the home page, a few posts or products, the WordPress admin, your forms, and the cart and checkout if you run a store. Watch for blank pages or error messages.
Run the vulnerability scan again
In GuardPress, run the vulnerability scan again. The PHP finding clears once the site runs a branch with more than 90 days of security support left.
Switch back to the previous PHP version from the same screen, then update the theme or plugin that failed (or contact its author) before trying again. An old plugin that no longer works on a supported PHP version is worth replacing.
FAQ
My host says PHP is fully patched. Why does GuardPress still warn?
Hosts and Linux distributions often backport security fixes into an older PHP branch without changing the version number, so the patch number alone can’t show whether a server is protected. GuardPress judges by PHP branch and the date the PHP project stops security support for it. If your host commits to patching that branch for longer, treat the warning as a reminder to plan the move.
Which PHP version should I move to?
The warning names a version: the oldest PHP branch that still has more than a year of security support left. Any newer supported branch is also fine, as long as your theme and plugins work on it.
Will changing the PHP version break my site?
Usually not, but an old theme or plugin can fail on a newer PHP version. Back up or use staging first, switch, then check the front end, the admin area, forms and checkout. Most hosts let you switch back in one click.
Which GuardPress version shows this warning?
The PHP security support check is part of the vulnerability scan in GuardPress Pro 1.6.54 and later.
- Vulnerability Scanner Explained: every other finding the scan can report
- GuardPress System Requirements: the WordPress and PHP versions GuardPress itself needs