How to update PHP in WordPress (and which version to choose in 2026)

WordPress is written in PHP, but it doesn't install or update PHP. PHP is a program on your hosting server, so its version comes from your host or from whoever manages the server. That matters this month: PHP released fixes on October 21, 2026 for 2 critical flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and updating WordPress alone doesn't apply them. Here is the whole process in 6 steps.

1. 1Back up your site. Save a full copy of your files and database, even if your host makes nightly backups, so you can roll back to the minute before the change. Many hosts offer a backup or restore point in their panel.
2. 2Write down your current PHP version. In WordPress, go to Tools, then Site Health, open the Info tab and expand Server. You'll want this number if you need to switch back.
3. 3Update WordPress, your theme and your plugins. Newer releases add support for newer PHP versions. Update first, then confirm the site still works before you touch PHP.
4. 4Check plugin and theme compatibility. Look up the PHP versions each plugin and theme supports, and ask the developer of any custom code. If you have a staging copy, switch PHP there first.
5. 5Change the PHP version at your host. In cPanel, that's MultiPHP Manager or Select PHP Version. Other hosts keep it in their own dashboard. If you can't find it, ask your host to make the change.
6. 6Test the site. Load your main pages, send a test form, place a test order if you sell online, and open the admin. Then check Site Health again to confirm the new version is live.

Which PHP version does WordPress recommend in 2026?

WordPress.org recommends PHP version 8.3 or greater on its requirements page. It says WordPress also works with PHP 7.4 and later, but warns that versions past their official end of life can expose a site to known security flaws.

Picking the line (8.3, 8.4 or 8.5) is half the job. For PHP2Shell, the exact release inside that line matters too: 8.3 needs 8.3.36 or later, and 8.4 needs 8.4.27 or later. You choose the line; your host installs the release.

If your plugins allow it, 8.4 or 8.5 gives you the most time before your next PHP upgrade, and 8.3 is the most conservative choice that still meets WordPress's recommendation. Each line has its own page: 8.5, 8.4, 8.3 and 8.2, and PHP versions and end-of-life dates has them all.

Why updating WordPress doesn't update PHP

WordPress, your theme and your plugins are PHP code. PHP itself is the program on the server that runs that code, and it belongs to the hosting account, not to WordPress. The Updates screen in WordPress can't reach it. That's why a fully updated WordPress site can still run a PHP release from before the PHP2Shell fix.

Site Health does notice: when your PHP is out of date, it lists it as a critical issue on the Status tab. The change itself still happens at your host. PHP for WordPress sites covers who updates what.

How to check WordPress PHP compatibility

The most reliable compatibility check is a real test: switch PHP on a staging copy and watch for errors. Before that, 3 quick checks catch most problems.

• Plugin listings and changelogs. Each plugin page on wordpress.org shows the minimum PHP version it needs and when it was last updated. A plugin that hasn't been updated in years is the likeliest to fail on 8.3 or 8.4.
• Premium and custom code. Ask the vendor or developer which PHP versions they've tested. Custom themes and plugins written years ago are where problems usually show up.
• Error logs after the switch. If your host offers PHP error logs, read them after the change. Deprecation warnings are a to-do list for your next upgrade.

How to update PHP in WordPress without cPanel

Not every host uses cPanel. Many keep the PHP version in their own dashboard, under a name like PHP settings, PHP version or PHP configuration. Search your host's help center for "change PHP version", or see our guides for GoDaddy, Bluehost, SiteGround, Hostinger, DreamHost and Namecheap. On cPanel, How to change PHP version in cPanel shows both screens.

If your plan has no PHP setting at all, your host controls the version. Send them a short request naming the line you want and the fixed release you need (8.2.35, 8.3.36, 8.4.27, 8.5.12). Your PHP Scanner result includes a ready-made email for this.

On managed WordPress hosting

Managed WordPress hosts run PHP for every site on their servers. Many let you choose the PHP line per site in their dashboard, while the patch release inside that line is theirs to install. Ask support 2 questions: which exact release your site runs, and whether the PHP2Shell fix is in. Our WP Engine, Kinsta and Cloudways pages show where each keeps the setting.

On a server you run yourself

On a VPS or dedicated server without a control panel, your developer updates PHP through the operating system's packages, then restarts PHP-FPM or the web server. PHP says Linux distributions received the patches in advance, so updated packages may already be waiting. See Ubuntu 24.04, Ubuntu 22.04 and Debian 12 for each default version.

What to test after you update PHP

Test the pages that bring in business first, then the admin. Use a private browser window so you don't see a cached copy.

• The home page and 3 or 4 inner pages, including your most visited landing page.
• Every form: send a test inquiry and confirm it arrives in the inbox.
• Checkout, if you run WooCommerce: place a test order and refund it.
• The admin: open the editor, save a draft and upload an image.
• Tools, then Site Health: confirm the new version under Info, then Server.

If something breaks, switch PHP back in the same screen (or ask your host to), restore your backup if needed, and send the plugin or theme developer the error. Don't stay on a release from before the fix longer than you have to: PHP2Shell workarounds explains the temporary settings PHP suggests while you sort it out.