The WordPress ecosystem stands at a critical technological crossroads. While millions of websites continue to hum along on aging infrastructure, beneath the hood, a silent security and performance crisis persists. Recent discussions at WordCamp Europe have brought this issue back into the sharp focus of developers, hosting providers, and site administrators alike.
In a recent episode of the Jukebox Podcast from WP Tavern, host Nathan Wrigley sat down with Milan Petrović—a veteran WordPress developer of nearly two decades and full-stack developer at Freemius—to unpack the alarming risks of legacy PHP and why upgrading is no longer just a best practice, but an urgent necessity.
Main Facts: The Growing Danger of Legacy PHP
At the heart of the conversation is a stark reality: a significant percentage of the WordPress ecosystem still relies on end-of-life (EOL) PHP versions, predominantly the PHP 7.4 branch and, in some rare instances, PHP 5.
While WordPress Core maintains a proud tradition of backward compatibility—a foundational strategy that fueled its massive global adoption—this legacy support has created a dangerous trap.
- The Scale of Outdated Software: Official WordPress tracking reveals that roughly 20% of monitored sites still run on PHP 7.4, with a small percentage lingering on even older versions.
- Thousands of Unpatched Vulnerabilities: EOL versions of PHP no longer receive security updates. Petrović notes that there are currently between 3,000 and 4,000 open, confirmed bug reports for PHP 7 and PHP 5 that will never be fixed.
- Open Invitations for Attackers: Because these vulnerabilities are publicly documented, relying on legacy PHP is an open invitation for automated botnets and malicious actors to execute exploits on the server level—independent of whether the CMS itself is secure.
Chronology: From Early Adoption to Modern Stagnation
To understand how the WordPress community arrived at this juncture, it is helpful to look at the historical timeline of the platform and its underlying language.
2007–2010s: The Era of Rapid Adoption
When developers like Milan Petrović—known for his work on bbPress forum plugins and his company Dev4Press—began building within the WordPress ecosystem, backward compatibility was paramount. Hosting companies could offer inexpensive plans because they did not need to constantly update server environments or invest in cutting-edge infrastructure. This frictionless onboarding process helped WordPress capture a dominant market share.
2019–2020s: The PHP 8 Milestone and EOL Realities
When PHP 8.0 was released, it marked a massive milestone for the language, introducing strict typing, constructor property promotion, and significant performance architecture upgrades. However, the wider WordPress ecosystem lagged in sweeping adoption.
Even though PHP 7.4 reached its official End of Life (EOL) over four years ago, WordPress Core continues to officially support it. This lag creates a cascading effect: core software, third-party plugins, and web hosts remain anchored to the lowest common denominator of hosting performance.
Supporting Data: Performance, Memory, and Security Shields
The debate over PHP versions often centers on security, but the performance dividends of modernizing are equally impossible to ignore. Petrović emphasizes that PHP has grown systematically faster and more efficient with every new iteration.
- Performance Boosts: Upgrading from PHP 7.4 to PHP 8.5 yields cumulative performance improvements exceeding 50%. Websites load faster with zero code modifications simply by updating the underlying server environment.
- Memory Optimization: Modern PHP releases drastically reduce memory usage. Benchmarking tests demonstrate that running the exact same block of code on PHP 8.5 consumes nearly half the memory required by older legacy branches. For hosting providers, this translates to conserved server resources and increased capacity to host more sites efficiently.
- Native Language Shields: Modern PHP provides strict typing and built-in architectural safeguards that neutralize common exploits—such as authentication bypasses and Server-Side Request Forgery (SSRF)—at the language level, eliminating the need to constantly "play whack-a-mole" with input sanitization.
Technical Insights: The Vulnerability Lab Plugin
To demonstrate these risks visually and practically, Petrović developed a diagnostic tool called the Vulnerability Lab plugin. Built specifically for his WordCamp Europe presentation, the plugin allows developers to run identical, flawed code segments across different PHP environments to observe the distinct outcomes.
- Legacy Behavior: On PHP 7.4, flawed or un-hardened code frequently results in security exploits, unintended data exposure, or server-level fatal errors depending on configuration settings.
- Modern Resilience: On PHP 8.x, native language restrictions and security shields intercept and neutralize these issues, ensuring code executes safely or fails gracefully without compromising the site.
Available on GitHub, the Vulnerability Lab plugin is designed primarily for developers and digital agencies. Agencies can utilize the tool to empirically demonstrate to clients why clinging to abandoned plugins and outdated PHP environments is a liability, effectively bridging the communication gap between technical risk and business reality.
Official Responses and Ecosystem Responsibilities
Addressing the PHP version gap requires a concerted effort across all tiers of the WordPress community:
- The Hosting Dilemma: While top-tier managed hosting providers actively force updates or deprecate ancient PHP versions, budget hosts often prioritize keeping legacy sites online to avoid customer support tickets. However, this preservation strategy trades short-term convenience for long-term systemic vulnerability.
- Third-Party Dependencies: Outside the WordPress bubble, modern PHP libraries are dropping support for legacy versions rapidly. Because third-party developers prioritize security and modern features over backward compatibility, plugin authors who rely on these libraries are increasingly forced to drop PHP 7 support.
- The Role of WordPress Core: Petrović suggests that while an overnight mandate moving exclusively to PHP 8.x might break millions of unmaintained sites, WordPress Core needs to accelerate its deprecation schedule. Signaling a firm cutoff for PHP 7.4 would encourage hosts, developers, and users to modernize proactively rather than reactively.
Implications: Building Secure, Future-Proof Products
The overarching takeaway for the WordPress community is clear: security cannot rely solely on the application layer. While WordPress provides robust built-in security features—such as data escaping and sanitization—these safeguards must be paired with a modern, secure server environment.
Actionable Steps for Stakeholders:
- For Developers: Adopt a gradual upgrade policy. Set a minimum requirement (such as PHP 8.0 or higher), enforce strict typing, and refactor codebases incrementally rather than waiting for a massive, disruptive overhaul.
- For Agencies and Freelancers: Audit client portfolios using tools like the Vulnerability Lab plugin to prove the performance and security costs of staying on outdated software.
- For End Users: Log into hosting control panels (such as cPanel or managed dashboards) and verify that your site is running a currently supported version of PHP (ideally PHP 8.2 or 8.3 and above).
As the web continues to evolve, the cost of inaction compounds daily. By embracing the performance efficiencies and native security shields of modern PHP, the WordPress ecosystem can shed its legacy vulnerabilities and build a faster, safer foundation for the future.
For more episodes and to listen to the full interview with Milan Petrović, visit the WP Tavern Podcast.
