PHP end of life: what PHP 8.2 ending in December 2026 means for your website

The short answer: PHP 8.2 gets its last security fixes from the PHP project on 31 December 2026. Your website won't stop working on 1 January, but any security flaw found in 8.2 after that date won't be fixed. If your site runs WordPress, check your PHP version now. Then plan a move to PHP 8.3, 8.4 or 8.5 with your host before the year ends.

When does PHP 8.2 reach end of life?

PHP 8.2 reaches end of life on 31 December 2026. The PHP project supports each version for four years.

For the first two, bugs and security problems are fixed. For the next two, only critical security issues are. After that, a version gets nothing at all.

Because PHP 8.2 came out on 8 December 2022, its four years run out at the end of 2026. Check the php.net table below for every supported PHP branch:

Don't let the 8.4 row worry you. Although its bug-fix period ends on the same day, PHP 8.4 keeps getting security fixes for two more years.

Everything from PHP 8.1 down is already out of support. PHP 8.1's end came on 31 December 2025, and 7.4's on 28 November 2022.

What happens to your website on 1 January 2027?

Nothing you'll see. Your site keeps loading, and your host won't necessarily switch anything off. The change is that the PHP project stops releasing fixes for 8.2. php.net says users of an end-of-life version "should upgrade as soon as possible, as they may be exposed to unpatched security vulnerabilities."

The UK's National Cyber Security Centre (NCSC) puts the risk plainly. Once a product is unsupported, it warns, "new vulnerabilities will be discovered that can be exploited by relatively low-skilled attackers." Its advice on old software is just as clear: "The only fully effective way to mitigate this risk is to stop using the obsolete product."

October 2026 showed what that looks like in practice. When the critical PHP2Shell flaws were fixed on 21 October, the PHP project shipped new releases for 8.2 to 8.5.

PHP 8.1 didn't get one, and its developers said "PHP 8.1 and older no longer receive updates from the PHP project". Although they published minimal source backports, those were only for people who build PHP themselves or have no paid support vendor. If a flaw like that turns up in the new year, a site on PHP 8.2 will be stuck in the same spot. Read our PHP2Shell guide for the full story.

How many websites are still on PHP 8.2?

A lot. WordPress.org publishes a snapshot of the PHP versions that WordPress sites run. When we checked on 10 November 2026, its figures showed:

If nobody moves before the deadline, about 55% of WordPress sites will run on PHP that gets no fixes from the PHP project. That's our sum of WordPress.org's published shares, not a separate survey. If your site isn't in the other 45% yet, the rest of this guide shows how to get it there.

How do you check which PHP version your site uses?

In WordPress, it's a few clicks. Go to Tools, then Site Health, then the Info tab, and open the Server section. You'll see "PHP version" there. WordPress.org says the dashboard may also show a "PHP Update Required" or "PHP Update Recommended" warning if you're behind.

If you can't log in to WordPress, look in your hosting control panel for a PHP setting. Or ask your host directly, with the email template below. WordPress runs on PHP, so every self-hosted WordPress site has a PHP version that someone has to keep current.

Which PHP version should you move to?

WordPress recommends PHP 8.3 or greater. WordPress 7.0 and 7.1 are listed as compatible with every PHP version from 7.4 to 8.5. So WordPress itself won't hold you back. Your theme and plugins might, so testing matters more than the PHP number you pick.

Based on the PHP dates above, here's our own advice:

One catch on 8.5: WordPress's own table doesn't list 6.8 or older as compatible with it. Update WordPress first, then change PHP. If your host offers 8.4 and your site passes testing on it, that's two years before you need to think about PHP again.

How do you upgrade PHP without breaking your site?

Back up, update everything, check your plugins, then switch. That's the order WordPress.org's own guide sets out. It's honest that it "can't guarantee" an update will go smoothly, because it doesn't know if your themes or plugins will work on newer versions. The steps are:

1. Make a backup you can restore. To roll back, you'd also need your host to put the old PHP version back.
2. Update WordPress, your theme and every plugin, then check the site still works.
3. Check compatibility with the PHP Compatibility Checker plugin. WordPress.org says it "isn't perfect and may miss items or flag false positives".
4. Fix or replace anything it flags, by asking the developer or switching to a similar plugin.
5. Change the PHP version in your hosting panel, or ask your host to do it.

If your host offers a staging copy of the site, we'd add one step of our own: try the new PHP version there first. Since WordPress.org can't promise your plugins will cope, a copy is the safe place to find out. After the PHP switch, check your contact form and any checkout.

What should you ask your web host?

Ask three things. Which PHP version does your site use, and which newer versions do they offer? And what will they do with 8.2 sites after 31 December? Copy this and add your domain:

Hello, my website is example.co.uk. PHP 8.2 reaches end of life on 31 December 2026. Which PHP version does my site run on, and which newer versions do you offer? What do you plan to do with sites still on PHP 8.2 after that date? If you'll keep patching 8.2 yourselves, please tell me how. Thank you.

That last question matters. When the PHP project announced PHP2Shell, its developers noted that "some distributions and LTS vendors provide backported fixes" for versions it no longer supports. Because of that, a host may tell you it'll keep older PHP patched itself. That can be true, but it's their promise, not the PHP project's. Get the answer in writing, and still plan your move.

Does PHP end of life matter for Cyber Essentials?

It can. If your business holds Cyber Essentials, the scheme's requirements say all in-scope software must "be licensed and supported". When software becomes unsupported, it must be removed, or cut off from all internet traffic and taken out of scope. The NCSC requirements define supported software as software a vendor "has committed to support by providing regular vulnerability fixes".

Whether your web server counts as in scope under Cyber Essentials depends on how it's hosted and who manages it. Because the requirements say cloud services can't be excluded from scope, don't assume your hosting sits outside it. If you're unsure, ask your certification body before your next renewal.

What if you don't want to deal with PHP at all?

You've got two routes, and this is Renozer's own view of them. The first is to keep WordPress and have someone own the updates: PHP, WordPress, theme and plugins, every month. Our Website Care plans cover updates, backups and monitoring from £49 a month, and Care Plus adds UK hosting for WordPress sites at £79 a month. There's no VAT to add.

The second is to leave PHP behind.

A static website has no PHP running on the server, so there's no PHP version to keep up with. It won't suit every site, and we're upfront about when it doesn't on our WordPress alternative page. If you're weighing that up, our guide on whether WordPress is still worth it in 2026 compares the running costs.

Questions people ask

Sources

• php.net: Supported Versions
• php.net: Unsupported Branches
• NCSC: Obsolete products (device security guidance)
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
• WordPress.org: Stats, PHP versions in use (data from api.wordpress.org/stats/php/1.0/, read 10 November 2026)
• WordPress.org: Requirements
• WordPress Core Handbook: PHP Compatibility and WordPress Versions
• WordPress.org: Get a faster, more secure website: update PHP today
• NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (PDF)