How to upgrade your site's PHP version
On most hosting you change the PHP version yourself, in the control panel. The switch takes a minute, but old themes, plugins and custom code can break, so prepare first. To be safe from PHP2Shell, choose PHP 8.3.36 or newer.
Which version to choose
PHP 8.4 or 8.5
The best choice if your site runs on it. Security fixes continue until 31 December 2028 for 8.4 and 31 December 2029 for 8.5.
PHP 8.3
Safe from 8.3.36. Security fixes continue until 31 December 2027, so plan the next move within a year.
Not 8.2 or older
8.2.35 fixes PHP2Shell, but 8.2 stops getting security fixes on 31 December 2026. PHP 8.1 and older get no fix at all.
Before you switch
Note the current version
Write down the version the site runs now, so you can switch back if something breaks. WordPress shows it in Tools → Site Health → Info → Server.
Make a backup
Download a full backup of the files and the database from your hosting panel, or check that your host's automatic backup is recent.
Update everything
Update the CMS, themes and plugins first. Outdated add-ons are the most common reason a site breaks on a newer PHP version.
Test on a copy
Many hosts offer a staging copy of the site. Switch PHP there first and try the pages that matter: home, contact form, checkout and login.
Where to change it
Menu names differ slightly between hosts and change over time. If you can't find the option, search your host's help pages for “PHP version”.
cPanel
Open cPanel and go to Software → MultiPHP Manager. Tick your domain, choose the new version in the PHP Version list and click Apply. On hosts that use CloudLinux the option is called Select PHP Version: pick the version and click Set as current.
WHM
For server administrators: in WHM go to Software → MultiPHP Manager. You can set the server's default version or change it per domain. A version that isn't listed has to be installed first with EasyApache 4.
Plesk
Go to Websites & Domains, open the domain's PHP Settings, choose the new version and click OK or Apply.
GoDaddy
On cPanel hosting plans, follow the cPanel steps above. On Managed WordPress, open the site from your GoDaddy account and change the PHP version in its settings.
HostGator and Bluehost
Both use cPanel. In HostGator, open cPanel and use MultiPHP Manager. In Bluehost, the Advanced section of your account opens cPanel, where MultiPHP Manager works the same way.
WordPress
WordPress doesn't change the PHP version itself. Change it in your hosting panel with the steps above, then open Tools → Site Health to confirm the new version and see any warnings.
Your own server
Install the new PHP packages from your distribution or a trusted repository, point PHP-FPM and the web server at the new version and restart both.
php -vshows the command-line PHP, which can differ from the one serving the site.
After you switch
Try the important pages
Open the home page, submit the contact form, log in to the admin area and, if you sell online, run a test order.
Check the error log
In cPanel, Metrics → Errors lists recent errors. In WordPress, Site Health shows problems it finds.
Confirm the version
Run the checker on your site. If the site hides its PHP version, confirm it in Site Health or your hosting panel instead.
If the site breaks
Switch back to the previous version in the same menu. The site works again within a minute while you find the cause.
The usual cause is code written for PHP 7 or older. PHP 8 removed functions such as
create_function()andeach(), and PHP 7 removed the oldmysql_database functions.Switching back is only temporary, because the old version is still open to PHP2Shell. Update or replace the add-on that fails, or ask a developer to fix the code.
If the code can't be fixed, we rebuild the site on a supported stack
Questions about upgrading PHP
Does upgrading PHP fix PHP2Shell?
Yes, if the version you end up on is 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer within its branch. Choosing 8.3 in the panel isn't enough on its own: your host's build has to include the fix, so check the exact version in Site Health or phpinfo().
Can upgrading PHP break my WordPress site?
It can, mostly through old themes and plugins. WordPress itself runs on current PHP versions. Update everything first, test on a staging copy, and switch back if something fails.
My host doesn't offer a newer PHP version. What now?
Ask when they will, and whether the version you run includes the PHP2Shell fix. If they can't upgrade, moving to a host that offers PHP 8.3 or newer is the usual way out. The hosting provider tracker lists what each host has said.