Why Upgrading PHP Matters for WordPress Security

Milan Petrović, a long‑time WordPress developer and Freemius full‑stack engineer, recently spoke at WordCamp Europe about an issue most site owners and some developers underestimate: the risks of running legacy PHP with WordPress, and the concrete gains of moving to modern PHP versions such as PHP 8.x.

Why PHP versioning matters

Many WordPress users notice a PHP version number in their hosting control panel but don’t appreciate what it actually affects. Milan’s message is simple: PHP isn’t just an implementation detail — its version dramatically impacts security, performance, and memory usage. PHP 8 introduced language features and internal hardening that neutralize entire classes of exploits that were common or unavoidable on older branches like PHP 7 and earlier.

The downside of extreme backwards compatibility

WordPress’ commitment to backwards compatibility helped the platform scale massively. It made hosting inexpensive and approachable for millions of sites. But that same policy has a downside: it slows adoption of safer, more modern server environments.

Milan points out that older PHP branches accumulate thousands of open, confirmed bugs that will never be fixed. Those publicly documented vulnerabilities become a roadmap for automated attacks that are agnostic to your CMS — attackers target the server runtime itself. While some hosts compile and patch custom PHP builds, that can introduce other differences and unknown quirks. Relying on patched, out‑of‑support branches is not a long‑term fix.

Security, performance, and cost benefits of PHP 8.x

Upgrading to modern PHP versions delivers multiple, immediate benefits:

• Security: Native language changes and stricter behaviors in PHP 8 blunt many common exploit techniques (authentication bypass, SSRF patterns, and more) that would otherwise work against legacy code.
• Performance: Newer PHP releases are significantly faster. Milan highlights large gains in execution speed and reduced memory consumption — meaning hosts can run more sites with the same resources.
• Maintainability: Modern PHP enables stricter typing and language features that make code clearer and easier to harden.

Who should act and how

This is a message for several audiences:

• Hosting companies: Migrating customers to newer PHP versions frees resources and reduces exposure. Managed hosts are already moving users forward, but migration requires testing and support to avoid breaking customer sites.
• Plugin and theme developers: Declare and adopt a sensible minimum PHP requirement (Milan has set 8.0+ for his plugins) and incrementally modernize code to use safer patterns and features.
• Site owners and agencies: Treat your site like maintained equipment — periodic upgrades matter. Where legacy plugins or custom code prevent immediate upgrades, plan staged migrations and testing.

Why WordPress can’t flip a switch — but what it can do

Technically, WordPress is already compatible with modern PHP versions, so setting a higher minimum is possible. The practical obstacles are the huge ecosystem of plugins, themes, and non‑technical site owners who depend on older code. Milan argues the right approach is gradual: declare a newer minimal PHP requirement to nudge the ecosystem, then modernize core and plugins over time. Even small, incremental changes — introducing stricter typing, using modern functions, adopting attributes — compound into a much safer codebase.

Vulnerability Lab: a practical demonstration

To illustrate the differences, Milan created a Vulnerability Lab plugin. It’s aimed at developers and agencies: install it on sites running different PHP versions to demonstrate how identical vulnerable code behaves across runtimes. Some examples show fatal errors on older PHP branches and safe execution on newer ones; others demonstrate memory and speed differences. The plugin is on GitHub and is intended to grow into a pattern library showing “old” vs “modern” approaches and which PHP versions support each pattern.

Use cases for agencies and maintainers

Agencies can use the Vulnerability Lab as a visual, practical tool to convince clients to modernize hosting or replace unmaintained plugins. Seeing a live demonstration of a broken plugin or a 50% memory improvement can turn abstract advice into an urgent, actionable task. Milan envisions a community‑driven collection of examples developers can use for testing and client reporting.

What to do next — practical steps

For developers and agencies

• Audit your plugins and themes for compatibility and upgrade paths. Prioritize popular or security‑sensitive components.
• Start small: introduce stricter typing and modern language constructs in non‑breaking ways, then expand gradually.
• Use tools and test environments to run code under multiple PHP versions and identify regressions.

For hosts

• Offer migration paths and automated testing tools so customers can move safely to newer PHP.
• Communicate benefits (security, speed, lower memory) clearly to less technical users.

For site owners

• Keep WordPress core, plugins, and themes updated.
• Talk to your host or developer about PHP upgrades and testing options before making changes on live sites.

Resources and learning

Milan recommends following the official PHP site for version changes and timelines, and watching how third‑party libraries increase their minimum PHP requirements. Those libraries often force upgrades faster than larger platforms because they don’t have to support millions of legacy sites.

Final takeaways

• Running end‑of‑life PHP leaves sites exposed to thousands of known issues that won’t be fixed; attackers can and do exploit these at scale.
• Modern PHP versions provide real, demonstrable benefits in security, performance, and memory usage. The gains are worth the migration effort.
• A pragmatic, community approach — gradual migration, improved tooling, developer guidance, and clear communication to site owners — will move the WordPress ecosystem forward.

Milan is available for further questions and has shared his Vulnerability Lab plugin and contact details in his WordCamp slides. If you’re responsible for sites, plugins, or hosting, start planning and testing PHP upgrades now: upgrading PHP isn’t optional maintenance — it’s core to keeping WordPress sites secure and performant.