Key facts
- End of support means no more official security fixes; the PHP version itself keeps working.
- PHP 5.6 reached end of support at the end of 2018; PHP 7.4 in late 2022. All of PHP 7 is now past it.
- The old mysql_ functions were removed in PHP 7, which breaks many scripts written before 2013.
- PHP 8 throws errors on wrong value types that older versions ignored.
- Some enterprise Linux vendors backport security fixes into old PHP version numbers.
- Test a copy of the site on the newer PHP before switching the live site.
- dijihost Complete Hosting runs PHP 5.6 to 8.5, selectable per site, for £1 a day + VAT.
What the email is really telling you
The email usually says something like "the PHP version your account uses is no longer supported and will be removed on the 30th", followed by a paragraph about security and a link to a help article. Before anything else: your website has not broken, and it will not break tonight. The message is about the software your host runs. You have time, and most of it is best spent finding out what you actually have.
PHP is the programming language most websites are built on. Each version gets a period of active development, then a stretch where only security fixes are published, then nothing. That last stage is what "no longer supported" means. The version keeps working exactly as it did; what stops is the flow of official fixes when a new flaw is found.
Version 5.6 reached that point at the end of 2018. Version 7.4, which a great many British business websites still sit on, ran out of security support in late 2022. Your host is not lying to you, but old PHP versions cost them money to keep, and the notice period is often set by that rather than any specific danger to your site this month.
Three emails that look the same
- A dated removal notice from your host. This is the real one. After the date, your account will be moved to a newer PHP whether or not your site copes. Diary it and read on.
- An automated warning from software on your site. WordPress Site Health, a plugin dashboard or a control panel notice. No deadline, nobody is going to switch anything, and it can wait until you have looked properly.
- A notice that the switch already happened. Usually spotted because a form stopped sending, a page went blank or the checkout threw an error. That one is urgent, and the first fix is often putting the old version back while you sort out the real problem.
Find out what you are actually running
Your control panel will have a PHP selector showing the version set for your site. Trust that over the version a command line reports, because on many servers those are two different PHP builds and the website uses the one you did not check.
One nuance changes the urgency completely. Some hosts run PHP packaged by an enterprise Linux vendor rather than straight from php.net, and those vendors backport security fixes into the old version number for the life of their operating system release. A site showing an old version on that kind of server may still be getting patches. Ask your host, in writing, which situation you are in. The answer decides whether this is a security problem or an administrative one.
Your four real options
Update the application. If the site runs on something with a maintained upgrade path, such as a current WordPress, a maintained framework or a supported shopping cart, bring the software forward and the PHP version follows without drama. Usually the cheapest answer.
Fix the code. For a bespoke site, a developer can run compatibility checking tools that list the incompatible code in a report, rather than you discovering it live. On a small site the list is often shorter than people fear.
Move to a host that will keep the old version running. Legitimate when the code cannot move yet, as long as the site is properly contained rather than left on an old shared server. That is what our legacy PHP hosting is for, and we are plain that it buys time rather than being a permanent answer. Our guide on keeping an old PHP site online safely explains what contained means.
Replace the site. Sometimes right, particularly when nobody has been able to change the site for years. It is also what people reach for in a panic when they had another eighteen months to plan, so read how the rebuild or move decision gets made calmly first.
The thing not to do
Do not open the control panel, pick the newest PHP from the dropdown and hope. It is behind a good many of the panicked calls we get a day later.
PHP has taken things away over the years as well as adding them. The old mysql_ database functions went in PHP 7, which alone kills a large number of scripts written before 2013. PHP 8 removed long-deprecated syntax and stopped being forgiving: passing the wrong sort of value into a built-in function now throws an error instead of carrying on, and the @ symbol older code uses to hide warnings no longer hides the serious ones.
None of that shows on the home page. It shows in the contact form, the checkout, the login and the invoice generator. So copy the site to a subdomain or test address, point the copy at the newer PHP and use it properly: submit the form, place an order, log in as an administrator, run the monthly report. Turn on error logging and read the log afterwards, because plenty of failures are silent. Only when the copy behaves does the live site move.
What your host's answer tells you
Ask by email so the reply is in writing. What you want is a test address on the newer version and a promise that the old version goes back if the site falls over. A host that offers both is being reasonable. A host that replies with a link to a knowledge base article has told you where you stand, and pricing up managed hosting, where a person handles this, is worth doing.
If you have a date and no idea what it means for your site, forward us the email with the web address and we will tell you, free, how much of a problem it really is. Ring 01623 650333 if you would rather talk. dijihost Complete Hosting is £1 a day + VAT for a straightforward site, and anything older is quoted once we have looked at the code.
Frequently asked questions
Will my website stop working when PHP support ends?
No. End of support means the PHP developers stop publishing security fixes for that version. Your site carries on running exactly as before. The risk builds up slowly afterwards, as new flaws are found and never patched. What breaks a site is usually the host switching you to a newer version, not the support date itself.
Can I just switch my site to a newer PHP version myself?
You can, and it works fine on modern software. On older code it tends to break the parts you cannot see from the home page: forms, logins, checkouts and reports. Copy the site to a test address first, switch that copy, use every function of the site properly and read the error log before touching the live one.
How long can I stay on an old PHP version?
Technically as long as you like, because nothing switches itself off. Sensibly, only as long as the site is contained: isolated from other websites, behind a current web server, with the admin locked down and real backups. Treat it as time bought to plan the next move rather than a permanent arrangement.
My host has given me a deadline. What should I do first?
Find out which PHP version the site runs now and which one your host will move you to. Then put a copy on a test address on the new version and see what actually breaks. That one afternoon turns a vague threat into a short list of jobs, and the list is often shorter than people expect.
What should I ask my host about a PHP deadline?
Ask three things in writing. What exactly happens on the date, and will the site be moved automatically or simply stop? Can they give you a test address on the newer version so you can check the site beforehand? And if it breaks, will they put the old version back while it is fixed, and for how long?
Related
Set it up and forget about it
Managed hosting, Plesk, Cloudflare DNS, daily backups and your domain for £1 a day + VAT. We move your site for you.