Your website's PHP version has an expiry date. Here is how to know before it passes.

By Bhavesh Narsai at BAV Tech Solutions. Published 23 October 2026.

Most websites, including every WordPress site, run on a piece of software called PHP. Every version of PHP stops getting security fixes on a date published years in advance. When that date passes, your website carries on exactly as before. Nobody emails you. Nothing looks different. It is simply unprotected from then on.

The PHP support schedule

These are the dates as they stood in October 2026, from the official schedule. Anything marked ended gets no security fixes, whatever happens.

For the live version, see the official PHP supported versions page or endoflife.date, which is the list Site Monitor reads every week.

Why nobody notices

A broken contact form at least shows up eventually, as a quiet month. An out of date PHP version shows up as nothing at all. The site loads, the pages look right, the shop takes orders. It goes out of date on a date in a calendar nobody at the business is looking at, and it stays that way until something forces the issue.

That is why it is so common. Security firm Qualys found that around 71% of the PHP installations it could identify were already on versions past end of life when a pair of critical PHP flaws was disclosed in October 2026. Most of those sites were not neglected in any way their owners could see.

What end of life costs you in practice

It costs nothing until the day a serious flaw is found, and then it costs a great deal. When the PHP2Shell flaws were fixed in October 2026, supported versions got an official update the same day. Sites on PHP 8.1 or older got none, and the US cyber security agency advised taking them offline until they were upgraded. Upgrading under that kind of pressure, with an old theme and plugins that may not cope, is the expensive way to do it.

Two ways a site falls behind

1. The version reaches end of life. Nothing to do with your site or your host. The date simply arrives. The fix is moving to a newer version, which usually means testing the site afterwards.
2. The host stops installing updates. The version is still supported, but security releases come out every few weeks and your server is several behind. On shared or managed hosting that is normally the host's job, and it is fair to ask them why it has not happened.

How to check your PHP version

• Hosting control panel: "Select PHP Version" or "MultiPHP Manager" in cPanel, PHP Settings in Plesk.
• WordPress: Tools, Site Health, the Info tab, then Server.
• From the outside: the free BAV Tech security check reads the version if your server shows it and tells you in plain English whether it is supported. If your server hides it, that is good practice, and the two methods above will tell you instead.

How Site Monitor watches it

Site Monitor re-checks your site every week and compares the result with the last one. For PHP and the security certificate, that means an email when:

• your PHP version passes its end of life date,
• it is within 90 days of end of life, so there is time to plan,
• a security release has been out for a fortnight and your server still has not installed it,
• your SSL certificate is close to expiring and has not renewed.

PHP is one of several things that break without anyone noticing. A plugin update that strips your phone link or stops your contact form sending is the other common one: why websites quietly break after updates.

It deliberately does not email you the day every routine PHP release comes out, or when a lookup fails for a minute. Each alert says what changed, what it risks and how to fix it, and a real person at BAV Tech can put it right if you would rather not. The rest of the time it says nothing, which is the point.

Common questions

How long is a PHP version supported?

Each PHP version gets two years of full support, then a further two years of security fixes only, so about four years in total. After its end of life date it gets no fixes at all. Recent versions follow the same pattern: PHP 8.2 is supported until 31 December 2026, 8.3 until 31 December 2027, 8.4 until 31 December 2028 and 8.5 until 31 December 2029.

What happens to my website when PHP reaches end of life?

Nothing you can see. The site keeps loading and working exactly as before. What changes is that any new security flaw found in that PHP version will never be fixed, so the server stays exposed to it permanently. Newer plugins also stop supporting old PHP, which leaves the rest of the site stuck out of date.

How do I check which PHP version my website uses?

Look in your hosting control panel (in cPanel, "Select PHP Version" or "MultiPHP Manager"; in Plesk, PHP Settings), or in WordPress under Tools, Site Health, Info, Server. Many servers also announce the version publicly, and the free BAV Tech security check reads it from outside and tells you whether it is still supported.

Is upgrading PHP my job or my host's?

Small security updates within the same version are usually your host's job on managed or shared hosting. Moving to a newer version, for example from 8.1 to 8.4, is usually a switch you or your developer choose in the control panel, because it can break old themes and plugins and needs testing.