PHP 7.1 arrived yesterday, but few small business sites should move to it yet. Find out which version yours runs: anything older than 5.6 needs attention now, and 7.0 is the sensible target until your plugins catch up.

A new version, and an old question

PHP 7.1 was released yesterday, Thursday. PHP is the programming language behind WordPress, Joomla, Drupal and most small business websites, and it runs on your host's server.

For developers it is a welcome release. For most site owners it changes nothing this week, and it should not be the next version their site moves to.

It is, though, a good moment to ask which version your site runs today. For a great many sites the answer is one that has already lost its security fixes.

Which versions still get fixes

Each PHP version normally gets about two years of full support, then a year of security fixes only, then nothing at all. PHP 5.6, the last of the 5 series, was given longer.

The third needs the most thought. A site on 5.6 is safe for now, but its next move, to PHP 7, is the biggest step it will take, and easier in a quiet month than against a deadline.

What 7.1 changes

Most of what is new helps programmers: clearer ways to declare what kind of value code expects or returns, and tidier error handling. Some code runs a little faster again.

It is also stricter. Code that calls a function with too few values now stops with an error where 7.0 only warned, and code that adds to a piece of text as if it were a list now fails outright.

An old encryption library, mcrypt, still works but is now marked for removal.

None of this matters to a visitor. All of it matters to code written for older versions.

Plugins and themes set the pace

WordPress itself is generally quick to support a new PHP version. A site, though, is WordPress plus its theme, its plugins and any code written specially for it.

Each has its own author, working at their own speed. Some test new versions before release; some take months; some stopped work years ago.

So the version a site can safely run is set by its least maintained part, and one abandoned plugin can hold back an otherwise current site.

Reading a plugin's signs

The WordPress plugin directory shows which version of WordPress each plugin was tested with, but usually says nothing about PHP. The other clues matter more.

A plugin untouched for two years was almost certainly never tested on PHP 7. A changelog that mentions PHP versions is a good sign, and so is an author who answers questions about PHP errors in the support forum.

Paid plugins and themes usually deliver updates only while their licence is current, so check that as well.

A worked example

A homebrew supply store sells malt, hops, yeast and equipment from a warehouse unit, and online through a WordPress shop with about twenty plugins.

When PHP 5.5 lost support in July, its developer moved the site to 5.6, a step that broke nothing, and set up a private copy on 7.0 the same month to see what would fail.

The copy failed in one place. A shipping calculator, abandoned by its author in 2013, used code that PHP 7 no longer accepts, and checkout showed no shipping rates at all.

Everything else, including the shop plugin, the payment plugin and the theme, had current versions that ran on 7.0 without complaint.

The plan was simple: stay on 5.6 through December, the store's busiest month for beer kits and gift equipment, replace the calculator in January, then switch to 7.0 the week after.

When the owner saw yesterday's news and asked about going straight to 7.1, the answer was no. That will be tested in the spring, once the shop and payment plugins mention it in their changelogs.

Why 7.0 is still the target

PHP 7.0 brought the big change: WordPress pages built in roughly half the time 5.6 needed, with far less memory. Version 7.1 adds little to that for a typical site.

It has full support until December 3 next year and security fixes for a year after, and most maintained plugins have had a year to fix their problems with it.

Moving from 7.0 to 7.1 later will be a far smaller step than the one from 5.6.

Upgrades as routine maintenance

Most sites change PHP version only when something forces it: a notice from the host, a failure, a deadline. That is the most expensive way to do it.

Treat the version like any other part of maintenance. Check it twice a year, write it down with the date, and review the plugin list at the same time.

Make the switch in a quiet week, with someone testing forms and checkout afterwards and a known way back. For a shop, that rules out December and the days before any big email or sale.

Ask your host how it handles old versions. Some move accounts on a date of their own choosing, and the warning may go to an address nobody reads any more.

The counter-case

Some sites have nothing to plan. A site built from plain HTML pages runs no PHP, and a hosted platform manages its own server software.

A site due to be rebuilt early next year can be built on 7.0 from the start, provided the rebuild has a real date. And a developer building something new may reasonably choose 7.1, on a host that offers it.

For everyone else: find your version, get off anything older than 5.6, plan the move to 7.0 for a quiet week, and let your plugins say when 7.1 is ready.

Planning the move to 7.0

  1. Ask your host which PHP version your site runs.
  2. List every plugin with its last update date.
  3. Replace plugins their authors have abandoned.
  4. Try PHP 7.0 on a private copy first.
  5. Book the switch for a quiet week.
  6. Record the version and date in your maintenance notes.
  7. Check again in spring for 7.1 support.

Step three is the one that unblocks the rest. An abandoned plugin is the usual reason a site is stuck on an old version, and no amount of waiting will fix it.

What a sudden rush of visitors does to a modest hosting plan is covered in a holiday email that brings the site down.

Frequently asked questions

What is PHP 7.1?

A new release of PHP, which powers WordPress and most other small business sites. It came out on December 1, adds features for programmers and is stricter about some old code.

Should my site switch to PHP 7.1 now?

Not yet. Most hosts do not offer it, and plugins and themes need time to confirm support. PHP 7.0 is the sensible target for now.

Which PHP versions no longer get security fixes?

PHP 5.3, 5.4 and, since July, 5.5. PHP 5.6 is moving to security fixes only, which continue for two more years.

Why do plugins decide when to upgrade?

Because a site runs only as well as its least maintained part. One abandoned plugin using code a new version rejects can break checkout or forms.

How can I tell if a plugin is maintained?

Check its last update date, read its changelog for mentions of PHP versions, and see whether the author answers questions about PHP 7 errors in its support forum.

When should the switch itself happen?

In a quiet week, with someone testing forms, checkout and the admin afterwards and a way to switch back. For a shop, that means after the holiday rush.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure which PHP version you run?

Share your site address and hosting details. We will look up the PHP version, list the plugins holding it back and plan the move.

Start a Conversation