PHP 8.2, the version of PHP that around a quarter of WordPress sites run on, stops receiving security fixes on 31 December 2026. If your charity’s website is one of them, nothing will break on New Year’s Day. But from then on, any new security hole found in PHP 8.2 stays open on your site until your host moves you to a newer version.
This is a short guide for whoever looks after your website, whether that’s a member of staff, a volunteer or a trustee. It covers how to check your version, what to move to and how to make the change without breaking anything.
The short version
- PHP 8.2 gets its last security fixes on 31 December 2026. PHP 8.3 is supported until the end of 2027, 8.4 until 2028 and 8.5 until 2029.
- It’s a big group. WordPress.org’s statistics show about 24% of WordPress sites on PHP 8.2 in October 2026, and roughly another 37% on versions that are already out of support.
- WordPress recommends PHP 8.3 or newer. WordPress 7.0 and 7.1 work with everything from PHP 7.4 to 8.5.
- Checking takes a minute: Tools, then Site Health, then Info, then Server. The upgrade itself is usually a setting your host controls.
- Test on a copy first. Old plugins and custom themes are what usually break.
What PHP is, and why the version matters
PHP is the programming language WordPress is written in. It runs on your web server rather than in your visitors’ browsers, so it’s your hosting company, not WordPress, that decides which version your site uses.
Each version of PHP gets two years of active support, when bugs and security problems are fixed, followed by two years of security fixes only. After that it gets nothing. PHP 8.2 came out in December 2022, so its four years are up at the end of December 2026.
| PHP version | Released | Security fixes until |
|---|---|---|
| 8.2 | 8 December 2022 | 31 December 2026 |
| 8.3 | 23 November 2023 | 31 December 2027 |
| 8.4 | 21 November 2024 | 31 December 2028 |
| 8.5 | 20 November 2025 | 31 December 2029 |
What actually happens on 1 January
Nothing you’ll see. Your site will keep working, and most hosts won’t switch PHP 8.2 off straight away. The risk is quieter than that: when a security flaw is found in PHP 8.2 after December, there won’t be a fix for it. Attackers keep track of which versions are unsupported, because those are the easiest targets.
Some hosts move customers up automatically, usually with a few weeks’ notice by email. That helps, but an upgrade you didn’t plan is also the moment an old plugin can take your site down, so it’s better to do it on your own timetable.
When a security flaw is found in PHP 8.2 after December, there won’t be a fix for it.
How to check which PHP version your site uses
- Log in to WordPress and go to Tools, then Site Health, then the Info tab. Open the Server section and look for PHP version.
- If Site Health is already showing a warning about your PHP version, WordPress has spotted that it’s out of date.
- No access to the dashboard? Your hosting control panel shows it too. In cPanel it’s usually under MultiPHP Manager or Select PHP Version.
- Or ask whoever looks after your site. It’s a thirty-second question.
Our free WordPress version checker will tell you whether your WordPress core and plugins are up to date. PHP is set on the server and most sites don’t reveal it publicly, so that one is best checked from the inside.
What to upgrade to
Move to PHP 8.3 or 8.4. WordPress recommends 8.3 or newer, and both versions have security support well beyond next year. PHP 8.5 works with WordPress too, but plugins can take a while to catch up with the newest release, so 8.4 is a sensible choice for most charity websites.
How to upgrade without breaking your site
- Take a full backup of your files and database, and make sure you know how to restore it.
- Update everything else first: WordPress itself, your theme and every plugin. Out-of-date plugins are the most common reason a PHP upgrade goes wrong.
- Look for plugins that haven’t been updated in years. A plugin with no release in the last two years may not run on newer PHP. Our version checker flags abandoned plugins for you.
- Test on a copy of the site. Many hosts offer one-click staging. Switch the copy to the new PHP version, then click through the pages that matter: the homepage, the donation form, contact forms, event booking and anything that was built specially for you.
- Switch the live site at a quiet time, then run the same checks again. Keep an eye on donation receipts and form submissions for a day or two.
- If something breaks, switch back to the previous version in your hosting panel, fix the plugin or theme that caused it, then try again.
Why this matters for charities in particular
“…all the trustees remain responsible for making sure your charity is protected…”
The Charity Commission’s guidance on cyber crime is clear that even when cyber security is handed to someone else, “all the trustees remain responsible for making sure your charity is protected”. Software that has stopped getting security fixes is an easy thing to miss and a hard thing to explain after an incident.
Your website also handles personal data: donations, contact forms and newsletter sign-ups. If the site is breached through out-of-date software, it’s still a breach your charity may need to report. If you’re working towards Cyber Essentials, the scheme also expects the software in scope to be supported and kept up to date.
We’ve written more about how charity websites get hacked and what the cleanup costs.
If you’d rather not deal with it
We can check your site’s PHP version, test the upgrade on a copy and switch it over for you. Get in touch, or look at our WordPress care plans if you’d rather not have to think about updates at all.
Questions charities ask
Will our website stop working on 1 January 2027?
No. Sites on PHP 8.2 will carry on working. They just stop getting security fixes for PHP itself, so any new flaw found after December stays unfixed.
Is PHP a WordPress setting?
No. PHP runs on your web server, so your hosting company controls it. Some hosts let you change it yourself in the control panel; others will do it if you ask.
Which PHP version should we choose?
PHP 8.3 or 8.4 for most charity sites. Both are supported by WordPress, and they get security fixes until the end of 2027 and 2028 respectively.
Do we need a developer to do this?
Not always. If your site uses well-maintained plugins and a standard theme, many hosts make it a two-click change. If you have a custom theme, older plugins or online donations, it’s worth having someone test it first.
