PHP 5.5 gets no more security fixes from today. Find out which version your site runs, test a copy on PHP 7.0 or 5.6, and move once forms, bookings and the admin all work.

Another version out of support

PHP 5.5 reaches its end of life today. From now on, security problems found in it will not be fixed.

It joins PHP 5.4, unsupported since last September, and PHP 5.3, unsupported since August 2014. All three still run a great many small business websites, especially on shared hosting where nobody has changed the version since the account was opened.

Nothing breaks today. A site on PHP 5.5 will look and work exactly as it did yesterday.

That is the trouble with this kind of deadline. The risk grows quietly, with each new flaw found and left unfixed, and nothing on screen ever says so.

What PHP does for your site

PHP is the programming language WordPress, Joomla and Drupal are written in, and with them a large share of small business websites. It runs on the hosting server, building each page as it is requested.

The host installs PHP and decides which versions are available. The site's code, including its theme and plugins, has to be compatible with whichever version it runs on.

So a PHP upgrade is a change to the machinery underneath your site, and the question is always whether your site's code is ready for it.

Where the versions stand

The third is the smallest step from where most older sites sit. The fourth is where they should be heading, because it runs WordPress roughly twice as fast as 5.6 and it is where the language is developing.

Finding your version

Many hosting control panels now show the PHP version for each site, and often let you choose it. Look for a section on PHP, software or server settings.

If yours does not, ask the host. The answer should name the version your site actually uses, not just what the server offers.

A developer can also check by placing a one-line file on the site that prints the server's settings. It should be deleted straight afterwards, since it shows details an attacker would like to see.

Moving to PHP 5.6

PHP 5.6 is a short step from 5.5 or 5.4, and most sites move to it without any changes.

One difference catches a few. PHP 5.6 checks security certificates by default on some connections that earlier versions left unchecked, so a contact form that sends through a mail server with a mismatched or self-signed certificate can stop sending.

That usually shows up as a form that appears to work but delivers nothing, which is why it has to be tested rather than assumed.

Moving to PHP 7.0

PHP 7.0 is a bigger change. Pages build much faster and use less memory on the server, which a busy site or a crowded shared server feels at once.

It also removed old features that had been flagged for years. The original functions for talking to MySQL databases are gone, along with an old set of functions for matching text patterns.

Code that still uses them, typically an old theme, an abandoned plugin or a custom form written years ago, fails with an error or a blank white page.

WordPress itself is ready for PHP 7. What decides the outcome is everything that has been added to it.

Test on a copy first

Switching the version on the live site and seeing what happens is a poor test. If something fails, visitors see the error while you work out what went wrong.

A copy of the site at a test address, set to the new version, lets you check everything privately. Go through every form, the booking or checkout process, the admin area and a sample of pages.

Then read the error log. Problems that do not show on screen often appear there first.

A worked example

A yoga retreat centre on a rural island property runs weekend and week-long retreats from a WordPress site built in 2011.

The site has a custom booking enquiry form written by its first developer, and a gallery plugin that has not been updated in three years.

The site was on PHP 5.4, the default when the hosting account was opened. Nobody had looked since.

Its current developer made a copy and set it to PHP 7.0. The home page loaded, but the booking form produced a blank page, because it used the old MySQL functions.

The gallery threw errors on every page that showed it.

On PHP 5.6 the copy worked completely, including a test booking and the confirmation email.

So the live site moved to 5.6 that week, a change made in the hosting control panel. A rewritten booking form and a replacement gallery are scheduled for November, when retreats are quiet, and the move to 7.0 will follow.

When the host is behind

Some shared hosts still offer nothing newer than 5.4 or 5.5, or move every account on a date of their own choosing.

Ask which versions are available and whether a change is planned. A host that cannot offer a supported version is telling you something about how its servers are maintained, and that is worth raising with whoever looks after your site.

The counter-case

A site built from plain HTML pages, with no PHP at all, is unaffected. So is a site on a hosted platform whose provider manages the server software.

If a rebuild is already planned for the next few months, the new site can go straight onto PHP 7.0, rather than testing an old site twice.

And a site on PHP 5.5 is not in trouble tomorrow. But unfixed flaws only accumulate from here, so plan the move this summer rather than waiting for something to fail.

Before the end of summer

  1. Find the PHP version your site uses.
  2. Ask your host which versions it offers.
  3. Make a full backup before touching anything.
  4. Copy the site to a test address.
  5. Switch the copy to PHP 7.0.
  6. Test forms, bookings and the admin area.
  7. Use 5.6 for now if 7.0 fails.

Step four is what makes the rest safe. A copy lets you find the blank page and the broken form yourself, before a customer does.

The same kind of end date arrived for office browsers in January, covered in old Internet Explorer stops getting fixes today.

Frequently asked questions

What happens to PHP 5.5 today?

It reaches end of life, so security problems found in it from now on will not be fixed. Sites running on it keep working exactly as before.

Which PHP versions are still supported?

PHP 5.6, which gets security fixes until December 31, 2018, and PHP 7.0, the current version. PHP 5.3, 5.4 and now 5.5 get no fixes.

How do I find my PHP version?

Many hosting control panels show it for each site and let you choose it. Otherwise ask the host which version your site actually uses.

What can break when moving to PHP 7.0?

Code using the old MySQL functions or old pattern matching functions, both removed in 7.0. That usually means an old theme, an abandoned plugin or custom code.

Is PHP 5.6 a safe step?

For most sites, yes. The main catch is that 5.6 checks certificates on more connections by default, so a form sending through a badly configured mail server can stop working.

Why test on a copy?

Because switching the live site means visitors see any errors while you work them out. A copy at a test address lets you check everything privately first.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Site still on PHP 5.5 or older?

Tell us where your site is hosted. We will check its PHP version and test a copy on 7.0 for you.

Start a Conversation