Most small business sites run on PHP, and many still use 5.6 or 7.0, which are both out of security support by Thursday. Find your version, then have whoever maintains the site test an upgrade on a copy.

The language underneath your site

Underneath WordPress, and many of the other systems small business websites are built on, is a programming language called PHP. Your host runs it, and it assembles every page your site shows.

Like any software, it comes in versions, each supported for a fixed period. PHP 5.6 stopped receiving security fixes on December 31. PHP 7.0 stops on Thursday.

A large number of small business sites still run one of the two. Their owners mostly do not know, because nothing on the site looks any different.

It will not look different on Friday either. That is the difficulty with this kind of deadline.

What the end of support means

When a version reaches the end of its support, the people who maintain PHP stop fixing it. Flaws discovered after that date stay in it.

The site keeps working. Nothing switches off, no warning appears, and visitors see exactly what they saw the day before.

What changes is the direction of travel. Each month adds known problems that will never be fixed in that version, and plugin authors gradually stop testing against it.

The risk does not arrive on a date. It accumulates, quietly, from one.

Finding out which version you run

The fourth is the one worth testing. If whoever looks after your site cannot answer straight away, that tells you something about how closely it is being looked after.

Why hosts leave older accounts behind

Hosting companies rarely move a site to a newer PHP version without being asked, and the reason is understandable.

Changing the version can break a site. A host with thousands of accounts cannot test each one, and a site that stops working after a change the host made becomes a support call, a refund, or a lost customer.

So an account tends to keep whatever version it started with.

Some hosts send warnings as a version approaches its end. They go to whoever opened the account, which may be a developer you stopped working with years ago.

What breaks, and why

PHP 7 was a large change, and among other things it removed a number of old functions that had been on their way out for years.

Code that still relies on one of those functions stops with what is called a fatal error. On a WordPress site, that usually means a blank white page, or an error message where the home page should be.

WordPress itself runs well on PHP 7. The trouble is almost always in a plugin or theme written years ago and untouched since.

Which is why the version question is really a question about everything else installed on the site.

What an upgrade involves

Done properly, an upgrade is a small project with a clear order, not a setting somebody flips.

First, everything else is updated: WordPress, the theme and every plugin. Most maintained code already works on PHP 7. Anything abandoned is replaced, since nobody will ever fix it.

Then a copy of the site is switched to the new version. Scanning tools can flag likely problems, but the copy is the real test.

On the copy, the pages that matter get checked: the home page, the main services, the contact form sent for real, any shop through to payment, and the editing screens.

Only then does the live site change, outside business hours, with somebody watching the error log for the days that follow.

A worked example

A renovation contractor had a site built in 2015 on a shared hosting account, still running PHP 5.6.

The host's warning emails had been going to the original developer's address for most of last year.

When the owner found the setting in the control panel, switching to 7.2 took one click. The home page went blank.

The cause was a photo gallery plugin, last updated in 2014, that relied on a function PHP 7 had removed. Every page showing the gallery stopped with a fatal error.

Switching back took another click and worked, because nothing else had changed at the same time.

The proper fix took a week: the gallery was replaced on a copy of the site, the copy was tested on 7.2, and the live site moved on a weekday evening.

Which version to move to

PHP 7.1 is still supported, but only until December 1 this year, so moving to it means doing all this again within twelve months.

PHP 7.3 is the newest version, released last month, and some plugins are still catching up with it.

For most small business sites, 7.2 is the sensible target this winter, with 7.3 once the site's plugins have caught up. WordPress itself recommends a current version of PHP 7.

A side benefit worth knowing

There is a reason to upgrade beyond security, and it rarely comes up.

PHP 7 does the same work with considerably less effort from the server, so pages are assembled faster and the editing screens often feel quicker too.

It will not rescue a site weighed down by enormous images. It does make every page PHP builds arrive a little sooner, at no extra cost once the upgrade is done.

The counter-case

Not every site is equally exposed.

A site made of plain HTML pages does not use PHP at all, and the question never arises.

A host that patches old versions itself reduces the security risk, though plugin authors will still drop support for those versions, so the upgrade is postponed rather than avoided.

And a site due to be replaced within weeks can reasonably move to the new version as part of the rebuild. That is a short wait with a date on it, not an indefinite one.

For everyone else: find the version, then have it upgraded properly, on a copy, this winter.

The upgrade, in order

  1. Find your version in the control panel.
  2. Take a full backup before anything changes.
  3. Update WordPress, the theme and plugins first.
  4. Replace anything abandoned for years.
  5. Test the new version on a copy.
  6. Switch the live site outside business hours.
  7. Watch the error log for a week.

Step five is the one that turns a gamble into a test. Switching versions on the live site usually works, and when it does not, customers are the first to find out.

The other change waiting on many WordPress sites this winter is covered in WordPress 5 and the new editor on your site.

Frequently asked questions

What does PHP actually do?

It is the programming language most small business sites, including every WordPress site, are written in. Your host runs it, and it assembles each page as it is requested.

What happens when a PHP version loses support?

Its maintainers stop fixing it, so flaws discovered afterwards stay open. The site keeps working exactly as before, which is why almost nobody notices.

How do I find my PHP version?

In your hosting control panel, from your host's support team, on a plugin's status screen, or by asking whoever maintains your site, who should know without looking.

Why did my host not upgrade it?

Because changing the version can break a site, and a host cannot test thousands of accounts. Older accounts usually keep whatever version they were set up with.

Which PHP version should I move to?

For most sites, 7.2 this winter. Version 7.1 loses support in December, and some plugins are still catching up with 7.3, which arrived last month.

What usually breaks during an upgrade?

Old plugins and themes that rely on functions PHP 7 removed. The result is usually a blank page, which is why the test belongs on a copy.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure which PHP version you run?

Send us the address. We will tell you the version, what depends on it, and what an upgrade involves.

Start a Conversation