Most website owners we speak to have automatic updates switched on and assume that means the site is secure. It's a fair assumption. WordPress updates itself, plugins update overnight, and the hosting company patches the server in the background.
What usually isn't updated is the version of PHP your site runs on. PHP 8.1 reached end of life on 31 December 2025, and PHP 8.2 follows on 31 December 2026. Yet when we check small business websites, and plenty of larger ones, an old PHP version is one of the most common gaps we find. Sites built three or four years ago are often still on PHP 8.1 or older, and nobody has noticed because everything else says "up to date".
This guide answers the questions we get asked most: does my host update PHP automatically, is my PHP version still supported, and how do I check and change it on Hostinger, SiteGround, Bluehost, GoDaddy, 20i, cPanel, Plesk and WordPress without breaking anything.
Does Hostinger update PHP automatically?
Usually not, and the same goes for most hosts. PHP is the software that runs WordPress and plenty of other websites behind the scenes. Each version (8.1, 8.2, 8.3 and so on) gets security fixes for a set period, then stops.
Hosts are good at the automatic part. They apply security patches for the version you're already on. What most of them won't do is move you from one version to the next, because a newer version can break an older theme or plugin. That decision is left to you, and if you don't make it, the site stays where it was when it went live.
Here's how the hosts we see most often handle it:
- Hostinger: you choose the PHP version in hPanel. It no longer lists anything below 8.2 as an option, but 8.2 itself only has until the end of the year, so check which version you're on.
- SiteGround: the exception. Its "Managed PHP" setting does move sites to newer versions automatically and is on by default for new accounts. If a version was ever picked by hand, the site stays on it.
- Bluehost, GoDaddy and 20i: you choose the version, and it stays put until you change it.
- Any cPanel or Plesk hosting: the version is set per site and stays put until someone changes it.
So "auto-updates on" can mean very little. Once a PHP version is out of support, there are no more security fixes for your host to apply.
Is PHP 8.1 still supported? PHP end of life dates
No. These are the dates published by the PHP project:
- PHP 8.1 and older: end of life, no security fixes. 8.1 ended on 31 December 2025, and anything older ended before that.
- PHP 8.2: security fixes end on 31 December 2026.
- PHP 8.3: supported until 31 December 2027.
- PHP 8.4: supported until 31 December 2028.
If you're on 8.1 or older, move now. That includes the critical "PHP2Shell" flaws announced this month, which were fixed for 8.2 and newer but not for 8.1 (see our article on the critical PHP security update). If you're on 8.2, plan the move before the end of the year.
For most sites we'd suggest PHP 8.3 or 8.4. WordPress itself recommends PHP 8.3 or newer. 8.4 gives you the longest runway, 8.3 is the safer choice for an older site with a lot of plugins.
Some hosts offer their own extended support builds of older versions. That's better than nothing, but treat it as a stopgap rather than a reason to stay put.
How many websites are still on an old PHP version?
More than you'd think. W3Techs, which tracks the technology behind millions of websites, reported these figures for PHP sites on 27 October 2026:
- About a third of PHP websites are still on PHP 7 or older (26.6% on PHP 7, 7.7% on PHP 5).
- Of the sites on PHP 8, around one in five are on 8.0 or 8.1, both end of life.
- A further 27% of PHP 8 sites are on 8.2, which loses support in two months.
Put together, that's roughly half of all PHP websites on a version with no security fixes, and close to two thirds once 8.2 runs out at the end of the year. These figures only count sites that reveal their PHP version, so the real picture may be a little different, but the direction is clear.
Before you change anything
The change itself takes a couple of minutes. The preparation is what keeps it painless.
- Take a backup. A full backup of files and database, either from your hosting panel or a backup plugin. Make sure you know how to restore it.
- Update everything else first. WordPress, your theme and all plugins. Developers fix compatibility issues in their updates, so an out-of-date plugin is the most likely thing to break.
- Look for anything abandoned. A plugin or theme that hasn't been updated in two or three years is a warning sign. It may not work on newer PHP, and it's probably a security risk in its own right.
- Use staging if you have it. Many hosts, including Hostinger, SiteGround and Bluehost on their WordPress plans, let you make a copy of your site. Switch the copy first and test it.
- Note your current version, so you know what to go back to.
How to check your PHP version in WordPress
In your WordPress admin, go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version is listed there. WordPress will also warn you on the Site Health status page if your version is out of date.
You can't change the version from inside WordPress. That's done in your hosting panel, below.
How to change your PHP version on each host
Hostinger (hPanel)
Go to Websites, click Dashboard next to your site, then open PHP Configuration in the sidebar. Choose the version and click Update. It can take a couple of minutes to apply, and the change covers every website on the plan.
SiteGround (Site Tools)
Go to Websites, choose your site and open Site Tools. Then go to Devs, PHP Manager. The PHP Version tab shows your current version and whether Managed PHP is on. Click the pencil icon to change it, or to switch Managed PHP on.
Bluehost
Log in to the Bluehost portal, go to Hosting, then My Plans, and click the cPanel button. In cPanel, open MultiPHP Manager under Software, tick your domain, choose the version from the PHP Version drop-down and click Apply.
GoDaddy
Your current version is shown on your hosting dashboard. To change it, go to your GoDaddy products page, click Manage next to your hosting, open the Settings tab and click Change next to PHP Version. Choose the version and save.
20i
In My20i, choose Manage Hosting, find your package and click Options, then Manage. Under Web Tools, select Change PHP Version and pick the new one. It applies within a minute or so.
cPanel (many UK hosts)
Open cPanel, go to the Software section and choose MultiPHP Manager. You'll see each domain and its current version. Tick the domain, choose the new version from the PHP Version drop-down and click Apply. Some hosts use a "Select PHP Version" tool instead, which works in much the same way.
Plesk
Go to Websites & Domains, find your site and click PHP Settings (or PHP on the site's dashboard). Choose the new version from the PHP version drop-down and click OK or Apply.
If your site is hosted somewhere else, the setting is almost always called PHP Version, PHP Settings or PHP Manager somewhere in the control panel. If you can't find it, your host's support team can tell you in a minute.
Site broken after a PHP update? How to roll back
Give it a few minutes after switching, then go through the site properly:
- Load the home page and your main pages.
- Submit your contact form and check the email arrives.
- If you sell online, run a test order through to payment.
- Log in to WordPress and check the dashboard and Site Health page for warnings.
If something has broken, don't panic. Switch back to your previous version in the same place you changed it, and the site will return to how it was. Then find the plugin or theme causing the problem, update or replace it, and try again. A white screen or "There has been a critical error on this website" message almost always points to one plugin, and the error log in your hosting panel will usually name it.
Quick answers
Do WordPress auto-updates update PHP?
No. WordPress auto-updates cover WordPress itself, plugins and themes. PHP is part of your hosting, so the version only changes when you or your host change it.
Is my website safe if auto-updates are on?
Not necessarily. Auto-updates keep the software on top of PHP current, but if the PHP version underneath is end of life, there are no more security fixes for it.
What PHP version should I use for WordPress?
PHP 8.3 or 8.4. WordPress recommends 8.3 or newer, and both are supported until at least the end of 2027.
Is it safe to update PHP?
Yes, as long as you take a backup first and test the site afterwards. If anything breaks, switching back takes a minute.
The real problem: websites nobody looks after
An old PHP version is usually a symptom of something bigger. Most small business websites are built, launched and then left alone. The developer moves on to the next job, the hosting renews every year, and nobody is actually responsible for the site any more.
That's when things drift. PHP falls out of support, a plugin gets abandoned, the security certificate fails to renew, or the site goes down over a weekend and nobody notices until a customer mentions it on Monday. None of this is dramatic on its own, but your website is often the first thing a new customer sees, and an unmanaged one is an easy target.
It doesn't need a lot of effort, it just needs someone whose job it is. That can be you, your web developer or us. We can manage and monitor your website alongside the rest of your IT, so updates like this one get done and problems get picked up before your customers find them.
How we can help
If you'd like to know where your business stands, or you'd rather someone else kept an eye on your website, there are three easy ways to start:
- Run a free domain scan. It checks your email security and DNS, and flags an out-of-date PHP version where your web server reveals it.
- Book a free IT Health Check. A wider look at your setup, from accounts and devices to backups, with an engineer on Teams or on your own.
at a time that suits you, and we'll talk through managing and monitoring your website, hosting and security for you, without the jargon.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
