Most small-business websites are built on WordPress, and WordPress runs on PHP. On December 31, 2026, PHP 8.2 reaches end of life: no more security fixes, ever. Any site still on it after that date is running software that will not be patched when the next vulnerability is found.
Where each version stands
- 8.1 and older: support already ended Dec. 31, 2025. Upgrade now.
- 8.2: support ends Dec. 31, 2026. Upgrade before year-end.
- 8.3: supported through Dec. 31, 2027. A safe target.
- 8.4: supported through Dec. 31, 2028. The best target if your plugins support it.
The 10-week plan
- This week: find out what you run. In WordPress, go to Tools → Site Health → Info → Server. Your host’s control panel shows it too.
- Weeks 2–3: back up everything. Files and database, stored off the server. Test that the backup actually restores.
- Weeks 3–4: update plugins and theme. Abandoned plugins, with no update in a year or more, are the most common reason an upgrade breaks a site. Replace them now.
- Weeks 5–6: test on staging. Most hosts let you clone a site. Switch the copy to 8.3 or 8.4 and click through forms, checkout and logins.
- Weeks 7–8: switch production. Pick a quiet day, change the version in your hosting panel, and watch for errors for 48 hours.
- Weeks 9–10: clean up. Remove unused plugins and themes, and turn on automatic minor updates.
Why it matters beyond security
Newer versions are also faster, which helps page speed and search rankings. And WordPress 7.0, released in May, raised its minimum requirement to 7.4. Very old setups are already being left behind on new features.
Not sure what your site runs on? Fenway Web will check your server version, plugins and backups for free and tell you exactly what needs to change. Request a site check →
Sources: HeroDevs support timeline · DreamHost on WordPress 7.0. Written by the Ecosystem Intelligence Desk.
