Is your websiteon PHP 8.2?
On 31 December 2026, PHP 8.2 stops getting security fixes. Nearly one in five PHP websites runs it, including many WordPress sites. Here is what that means, how to find out if yours is one, and what to ask your developer while there is still time.
What is happening
PHP is the language behind WordPress, WooCommerce, Joomla, Drupal and a large share of hand built sites. Each version gets two years of general fixes, then two more years of security fixes only. After that, the people who make PHP stop fixing it altogether.
PHP 8.2 came out in December 2022, so its four years are up on 31 December 2026. From 1 January, any new flaw found in it stays open, unless your host or Linux distribution fixes it themselves.
Why it matters to you
A site on an unsupported version usually works fine on the day. Nothing breaks. The risk builds quietly, with each new flaw that will never be fixed for it.
This month showed how that plays out. When the php2shell flaw was published, PHP released fixes for 8.2, 8.3, 8.4 and 8.5 within a day. Sites on 8.1 and older got nothing from PHP, because support for them had already ended. Next time, 8.2 will be in that group. Automated attack tools then try every website they can find, so a small business is just as likely to be hit as a big one.
How many sites run it
W3Techs, which surveys the web, finds PHP behind 69% of the websites whose language it can see. Of the sites it can see on PHP 8, 27.6% run 8.2. That is about 18% of all PHP websites, nearly one in five.
About 48% of PHP websites are already on versions with no support at all. After 31 December, that becomes about two in three.
WordPress publishes its own figures: 23% of WordPress sites report PHP 8.2, and 34% report something older.
These counts only include sites that say which version they run, so the real numbers are a little uncertain, but the picture is clear.
What to do before the deadline
Moving to a newer PHP is usually a setting in your hosting control panel. The work is in checking that your site still works afterwards, because old plugins, themes and custom code can stop working on a newer version.
- Find out which version you are on. Your host's control panel shows it, or ask your developer.
- Pick the version to move to. PHP 8.4 gets security fixes until the end of 2028 and 8.3 until the end of 2027. Either is a sensible move from 8.2.
- Test on a copy first. Many hosts offer a copy of your site, often called staging, where you can switch PHP over and click through the important pages before the real site changes.
- Update plugins and themes first. The newer versions are far more likely to work on newer PHP.
Ask your developer“Which version of PHP does our website run? If it is 8.2 or older, can you move it to PHP 8.4 before 31 December, and test the site on a copy first?”
Some hosts and Linux distributions keep fixing older versions themselves for a while. If yours says it does, ask them to confirm it in writing, and for how long.
How Mendbird helps
Many sites tell every visitor which version of PHP they run. The free check reads it, and from three months before a version's support ends, the report says so, with the date and the question to ask. Check your site to see which version yours shows.
On a Watch plan, the report is brought up to date every morning, so it also shows when support is running out for anything else the Mendbird can see, such as WordPress or your web server.
If your site hides its PHP version, which is good practice, the report says it could not tell rather than guess. The free Mendbird helper reads the exact version from inside the site.