The email lands on a Tuesday. Something along the lines of “the PHP version your account uses is no longer supported and will be removed on the 30th”. Then a paragraph about security, a link to a help article, and no phone number.
Before anything else: your website has not broken, and it will not break tonight. That message is about the software your host runs, not about your site failing. You have time to work out what to do, and most of that time is best spent finding out what you actually have rather than clicking anything.
What the email is really telling you
PHP is the programming language most websites are built on, and it comes in versions. Each version gets a period of active development, then a further stretch where only security fixes are published, then nothing at all. That last stage is what “no longer supported” means. The version keeps working exactly as it did. What stops is the flow of official fixes when a new flaw is found.
Version 5.6 reached that point at the end of 2018. Version 7.4, which an enormous number of British business websites still sit on, ran out of official security support in late 2022. Everything in the PHP 7 family is now past it, and the PHP 8 releases are working through the same cycle behind them.
Your host is not lying to you. They are also not usually in a rush for your benefit. Old PHP versions cost them money to keep on the estate, and the notice period is often set by that rather than by any specific danger to your site this month.
Three emails that look the same
They look alike and they mean quite different things.
- A dated removal notice from your host. This is the real one. There is a date, after which your account will be moved to a newer PHP whether or not your site copes. Diary the date and read on.
- An automated warning from software on your site. WordPress’s Site Health screen, a plugin dashboard or a control panel notice. No deadline attached, nobody is going to switch anything, and it can wait until you have looked properly.
- A notice that the switch already happened. Usually noticed because a form stopped sending, a page went blank or the shop’s checkout threw an error. That one is urgent, and the fix is often as simple as putting the old version back while you sort out the real problem.
Find out what you are actually running
Your control panel will have a PHP selector somewhere, and it will show the version set for your site. Trust that over the version a command line reports, because on a lot of servers those are two different PHP builds and the website uses the one you did not check.
One nuance that changes the urgency completely. Some hosts run PHP packaged by an enterprise Linux vendor rather than straight from php.net, and those vendors backport security fixes into the old version number for the life of their operating system release. A site showing an old version number on that kind of server may still be receiving patches. Ask your host, in writing, which of the two situations you are in. The answer decides whether this is a security problem or merely an administrative one.
What you can actually do about it
Update the application. If the site runs on something with a maintained upgrade path, this is the right answer and usually the cheapest one. A current WordPress, a maintained framework, a supported shopping cart: bring the software forward and the PHP version follows without drama.
Fix the code. For a bespoke site, a developer can find out what will break before anything is switched. Compatibility checking tools exist for exactly this and will list the incompatible code in a report rather than making you discover it live. On a small site the list is often shorter than people fear.
Move to a host that will keep the old version running. A legitimate choice when the code cannot move yet, as long as the site is properly contained rather than simply left sitting on an old shared server. This is what our legacy PHP hosting is for, and we say plainly on that page that it is a way of buying time rather than a permanent answer. Whether it is the right call for you depends on how much of a risk the old code actually carries, which is worth half an hour of anybody’s time first.
Replace the site. Sometimes the right answer, particularly when the site is a decade old and nobody has been able to change it for years. It is also the answer people reach for in a panic when they had another eighteen months to plan it properly, so it is worth seeing how the rebuild-or-move decision gets made calmly before you commit to it.
The thing not to do
Do not open the control panel, select the newest PHP from the dropdown and hope. It is behind a good many of the panicked calls we get a day later.
The reason is that PHP has not only added things over the years, it has taken things away. The old mysql_ database functions went in PHP 7, which alone kills a large number of scripts written before 2013. PHP 8 removed several long-deprecated bits of syntax, and more importantly it stopped being forgiving: passing the wrong sort of value into a built-in function now throws an error instead of shrugging and carrying on, and the @ symbol that older code sprinkles about to hide warnings no longer hides the serious ones.
None of that shows up on the home page. It shows up in the contact form, the checkout, the login, the invoice generator. The parts nobody tests by looking.
Do it this way instead. Take a copy of the site onto a subdomain or a test address, point that copy at the newer PHP, and use it properly. Submit the form. Place an order. Log in as an administrator. Run the report that the office manager runs on the first of the month. Turn on error logging while you do it and read the log afterwards, because plenty of failures are silent. Only when the copy behaves does the live site move.
What your host’s answer tells you
Ask by email rather than on the phone, so the reply is in writing. What you want out of them is a test address on the newer version and a promise that the old one goes back if the site falls over. The questions worth sending are in the FAQs below.
Their answer matters more than the deadline does. A host that offers a test address and a rollback is being reasonable. A host that answers with a link to a knowledge base article has told you where you stand, and moving to managed hosting where a person handles this sort of thing is worth pricing up while you are at it.
PHP version warning FAQs
Will my website stop working when PHP support ends?
No. End of support means the PHP developers stop publishing security fixes for that version. Your site carries on running exactly as before. The risk builds up slowly afterwards, as new flaws are found and never patched. What breaks a site is usually the host switching you to a newer version, not the support date itself.
Can I just switch my site to a newer PHP version myself?
You can, and it works fine on modern software. On older code it tends to break the parts you cannot see from the home page: forms, logins, checkouts and reports. Copy the site to a test address first, switch that copy, then use every function of the site properly and read the error log before touching the live one.
How long can I stay on an old PHP version?
Technically as long as you like, because nothing switches itself off. Sensibly, only as long as the site is contained: isolated from other websites, kept behind a current web server, with the admin locked down and real backups. Treat it as time bought to plan the next move rather than a permanent arrangement.
My host has given me a deadline. What should I do first?
Find out which PHP version the site runs now and which one your host will move you to. Then take a copy onto a test address on the new version and see what actually breaks. That one afternoon turns a vague threat into a short list of jobs, and the list is often shorter than people expect.
What should I ask my host about a PHP deadline?
Ask three things in writing. What exactly happens on the date, and will the site be moved automatically or simply stop. Can they give you a test address on the newer version so you can check the site beforehand. And if it does break, will they put the old version back while it is fixed, and for how long.
Forward us the email
If you have a date and no idea what it means for your site, send the message over with the web address and we will read it for you. You will hear how much of a problem it really is, free, and with no obligation attached to it. Our number is 01623 650 333 if you would rather talk. Prices begin at £1 a day + VAT for a straightforward site, and anything older is quoted after we have had a look at the code.
Leave a Reply