“Your site is running on an outdated version of PHP”: what WordPress means, and what to do

By CompatNav · Published · Last reviewed · 3 min read

Short answer

WordPress asks wordpress.org about your PHP version and shows the answer in Tools → Site Health (and, on PHP 7.4 and 8.0, on the dashboard). On PHP 7.4 and 8.0 it says the version is outdated and no longer gets security updates; on 8.1 and 8.2 it calls it an older version that should be updated; from 8.3 it’s green. The message itself changes nothing on your site. It tells you PHP should be updated, which you do in your hosting panel, after checking that your plugins and theme are ready for the new version.

Four messages, by PHP version

Site Health shows one line about PHP, which depends on your version and on wordpress.org’s answer about it. With WordPress 7.1.2 and wordpress.org’s answers on 16 October 2026 (source):

Your PHPSite Health saysShown asDashboard box
7.4“Your site is running on an outdated version of PHP (…), which does not receive security updates and soon will not be supported by WordPress.”CriticalPHP Update Required
8.0“Your site is running on an outdated version of PHP (…), which does not receive security updates. It should be updated.”CriticalPHP Update Recommended
8.1, 8.2“Your site is running on an older version of PHP (…), which should be updated”Recommendednone
8.3, 8.4, 8.5“Your site is running a recommended version of PHP (…)”Goodnone

The brackets hold your exact version, such as 7.4.33 or 8.2.29. Open the line, and Site Health adds “The minimum recommended version of PHP is 8.3.” The dashboard boxes are explained in your host is forcing a PHP upgrade.

WordPress admin, Tools → Site Health, Info tab, Server section open: the row “PHP version” reads 8.5.11.
Your exact PHP version is under Tools → Site Health → Info → Server.

Where the answer comes from

WordPress sends your PHP version to wordpress.org and keeps the answer for a week (WordPress 7.1.2 source). This is what wordpress.org answered for PHP 8.2:

api.wordpress.org · wordpress.org’s answer for PHP 8.2.29, asked on 16 October 2026, one value per line

{
  "recommended_version": "8.3",
  "minimum_version": "7.4",
  "is_supported": false,
  "is_secure": true,
  "is_acceptable": true
}

is_secure is the one that matters. WordPress’s own code explains it: “It only means it receives security updates.” (WordPress 7.1.2 source) For PHP 7.4 and 8.0 the answer was false, hence “outdated”.

One detail: wordpress.org gave PHP 8.1 exactly the same answer as 8.2, is_secure included, although php.net lists PHP 8.1’s security support as ended on 31 December 2025 (php.net). So a site on 8.1 sees the milder “older version” line while it runs without security fixes. Go by php.net’s dates:

PHPSecurity fixes (php.net)
7.4ended 28 November 2022
8.0ended 26 November 2023
8.1ended 31 December 2025
8.2until 31 December 2026
8.3until 31 December 2027
8.4until 31 December 2028
8.5until 31 December 2029

Sources: supported versions and end-of-life list on php.net.

Does it break anything?

No. Nothing switches off, and the site keeps running exactly as before. What changes with time is outside your site: security problems found in an unsupported PHP version are no longer fixed, and hosts move sites off old versions, sometimes on a date they choose (what PHP 8.2’s end of life means).

What to do

  1. Choose the version you’re moving to: PHP 8.3 or later, the newest your host offers that your site is ready for (how to choose).
  2. Check your plugins and theme for that version before you switch: PHP runs every one of them.
  3. Update or fix what will break.
  4. Switch in your hosting panel (where to find the setting), or ask your host.
  5. Open Site Health again. WordPress asks wordpress.org about the new version straight away, so the line turns green at once.

For step 2, CompatNav is a free plugin on wordpress.org that reads the code of every plugin and theme on your own server, for the PHP version you choose (8.0 to 8.5). It reports only what changes between the version Site Health shows and that one, and gives one verdict: “Safe to upgrade”, or “Not ready yet” with what to do first. Getting started shows the first scan; reading the report explains each finding.

Key takeaways

  • PHP 7.4 and 8.0: “outdated”, critical in Site Health, plus a box on the dashboard.
  • PHP 8.1 and 8.2: an “older version” that should be updated, a recommended improvement.
  • PHP 8.3 and later: “a recommended version”, nothing to do.
  • Go by php.net’s dates: PHP 8.1’s security fixes ended on 31 December 2025, 8.2’s end on 31 December 2026.
  • Update PHP in your hosting panel, after checking your plugins and theme for the new version; Site Health updates at once.

Frequently asked questions

Is my site at risk right now?

The message doesn’t mean anything happened. It means your PHP version gets no security fixes any more (7.4, 8.0, and in fact 8.1) or soon won’t (8.2, at the end of 2026), so problems found in it later won’t be fixed.

Can I just hide the message?

Hiding it doesn’t change the PHP version, and WordPress asks wordpress.org again every week. The message goes away by itself once the site runs PHP 8.3 or later.

Which PHP version should I move to?

wordpress.org recommends PHP 8.3 or greater. Take the newest version your host offers that your plugins and theme are ready for: 8.3 gets security fixes until 31 December 2027, 8.4 until 31 December 2028, 8.5 until 31 December 2029.

Check your own site before you upgrade

CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.

Get CompatNav on wordpress.org How it works

Sources

About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.