Still on PHP 7.4? What It Means for WordPress

When did PHP 7.4 reach end of life?

PHP 7.4 stopped receiving regular security updates at the end of 2022, according to GoDaddy's help page on extended support. That means your site has been running on software its makers abandoned for almost four years, unless your host adds its own fixes.

Why does WordPress warn me about PHP 7.4?

WordPress shows a "PHP Update Recommended" notice in the dashboard when your server runs an old version. The notice is a nudge from WordPress, not a sign that your site is hacked. It means the PHP version is outdated and that newer plugins and themes may stop supporting it.

Treat the notice as a real prompt. You can read the exact version under Tools, then Site Health, then Info, then Server.

How many WordPress sites still run PHP 7.4 or older?

More than most owners expect. The WordPress.org statistics feed shows about 19 percent of WordPress sites on a 7.x version, and about 2 percent on PHP 5 or 4 (our own calculation from the live feed on October 27, 2026). Across all PHP sites, W3Techs shows 34.4 percent on a major version that has been unsupported for over three years.

So you are not alone, but being in a crowd does not make the version safer.

Is PHP 7.4 dangerous after the php2shell flaw?

It carries more risk than a supported version. php2shell, announced October 21, 2026, lets an attacker run commands on the server without a password. The PHP team shipped minimal fixes for 7.4, 8.0 and 8.1 because the flaw was so severe, per its 2026 news page.

That was a one-time exception. The next serious flaw will most likely not get the same treatment. CISA added both php2shell flaws to its exploited-vulnerabilities list on October 26 and advised taking unsupported PHP systems offline until patched, per its alert. See our php2shell explainer for the full picture.

Can my host keep PHP 7.4 alive for me?

Some hosts can, for a limited time. GoDaddy's Managed WordPress plan lists extended support for PHP 7.4 from Zend running until November 2026, per the same help page. That is only weeks away. Extended support is a bridge, not a destination.

Ask your host three things:

• • What date does the extended support end?
• • Does it include the php2shell fix?
• • What will you charge after that date?

If answers are vague, plan to move.

What breaks when I move from PHP 7.4 to a newer version?

Old plugins, old themes and custom code are the usual culprits. Between 7.4 and 8.x, PHP removed or tightened several behaviors, so code written years ago can throw errors or show a blank page. Well-maintained plugins are usually fine. Abandoned ones are not.

This is why you test on a copy first. If something does break later, read My Site Broke After a PHP Upgrade.

What is the safest way to move off PHP 7.4?

Test on a staging copy, fix what fails, then switch with a rollback ready. Do not change the version on your live site first and hope. A 7.4 site usually jumps several versions at once, so the testing matters more than the switch itself.

• • Run the free PHP version checker to confirm what you run now.
• • Back up files and database.
• • Create a staging copy and set it to PHP 8.3 or 8.4.
• • Click through the contact form, login, checkout and booking pages.
• • Replace any abandoned plugin before the live switch.

How much does it cost to leave PHP 7.4?

For a standard WordPress site with up to 20 plugins, our fixed price is $3,500 for the WordPress PHP Upgrade, with a 30-day fix of regressions. A store or custom theme is $4,500. If you are unsure what you have, the $295 PHP Health Check gives you a written plan and is credited toward the upgrade within 30 days.

Custom PHP apps written on 7.x are scoped separately after a short audit. We cannot promise every old plugin will work, but you will know before the live switch.

Will my WordPress version cover me if PHP is old?

No. Updating WordPress does not update PHP, because they are separate pieces of software. WordPress runs on top of PHP, and your host controls which PHP version is installed. A fully updated WordPress on PHP 7.4 is still running on a version that lost regular security support.

That is why the PHP warning in your dashboard matters even when everything else is current. Ask your host to change the version, or have a developer do it for you after testing. A short test of your forms, logins and checkout afterward catches most problems before customers do.

What is the next step?

Find your version, ask your host for its end date in writing, and book the move. If you want it handled, book a call and send us your hosting provider. For the deadline on the next version up, read PHP 8.2 Ends December 31.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.