In the expansive and interconnected world of WordPress, the underlying engine that powers the ecosystem—PHP—often remains a silent, invisible component for the average user. While millions of site owners focus on the aesthetics of themes and the functionality of plugins, a significant, invisible technical debt is accumulating. According to security experts and developers within the WordPress community, continuing to run websites on legacy versions of PHP is no longer merely a "bad habit"—it is an open invitation for automated exploitation.
At the recent WordCamp Europe, Milan Petrović, a seasoned WordPress developer and full-stack engineer at Freemius, brought this issue to the forefront of the community’s consciousness. With nearly two decades of experience in the ecosystem, Petrović argues that the industry’s reliance on outdated PHP versions creates a massive attack surface that is, in many cases, entirely preventable.
The State of Play: A Chronology of Neglect
The relationship between WordPress and its hosting environment is rooted in a long-standing commitment to "democratizing publishing." Historically, WordPress has maintained a rigorous policy of backwards compatibility. This policy was essential in the early 2000s and 2010s; it allowed the platform to be hosted on virtually any server, regardless of how inexpensive or outdated the infrastructure was.
However, this strength has become a strategic liability.
- The PHP 7.4 Era: PHP 7.4 reached its "End of Life" (EOL) status over four years ago. Despite this, statistics from the WordPress community tracking project indicate that a staggering 20% of WordPress sites continue to operate on the 7.x branch.
- The Lingering Legacy: Even more alarming is the presence of sites still running on PHP 5.x—versions that have been unsupported for nearly a decade.
- The Disconnect: While hosting panels often display a notification suggesting a PHP update, these warnings are frequently ignored by non-technical users who operate under the assumption that "if it isn’t broken, don’t fix it."
Petrović likens this mindset to ignoring the maintenance of a bicycle. "You might expect your bike to work perfectly in ten years without any maintenance," he notes, "but the reality is that the chain will rust, the tires will deflate, and eventually, it will fail."
Supporting the Data: The Vulnerability Landscape
The primary danger of running EOL software is the total cessation of security patches. When a PHP version is no longer supported by the PHP Group, it stops receiving critical updates.
"I was genuinely alarmed when researching for my presentation," Petrović admits. "There are between 3,000 and 4,000 open, confirmed bug reports for PHP 7 and PHP 5 that will never be patched."
Because these vulnerabilities are publicly documented, they become a blueprint for malicious actors. Automated scripts—often referred to as "bots"—scan the internet for servers running these specific, vulnerable versions of PHP. Once a target is identified, the exploitation process is trivial. These attacks occur at the server level, meaning they can bypass many of the security protections that a WordPress plugin might try to implement.
The Performance and Security Case for Modernization
Modernizing to PHP 8.x and beyond is not just about patching holes; it is about architectural evolution. Newer versions of PHP offer significant performance gains that can translate directly into cost savings for hosting providers and faster load times for end-users.
Memory Efficiency and Speed
Petrović highlights that each major PHP iteration brings measurable improvements. "PHP 8.5 is significantly faster than 7.4, and it consumes less memory to execute the exact same piece of code," he explains. For large-scale hosting companies, this is a massive incentive. By migrating clients to modern PHP, hosts can increase the density of sites per server without sacrificing performance, effectively lowering their overhead while improving site stability.
Native Shields
Modern PHP introduces language-level features that make code "secure by design." These include strict typing, improved error handling, and robust type-checking. When developers utilize these features, they create applications that are naturally more resilient to common attack vectors like Authentication Bypass or Server-Side Request Forgery (SSRF).
Bridging the Gap: The Vulnerability Lab Project
To move the conversation from abstract theory to tangible reality, Petrović has developed an open-source tool called the Vulnerability Lab plugin. This tool allows developers to see exactly how code exploits behave differently across various PHP versions.
"The plugin is designed to be a mirror," says Petrović. "If you run a specific snippet of code on an outdated PHP version, you can see the exploit succeed. Run that same code on PHP 8.x, and the vulnerability is neutralized by the language’s own security improvements."
This tool serves as an educational asset for agencies and developers who need to demonstrate the necessity of upgrades to their clients. It provides a visual, irrefutable argument that moving away from legacy environments is a professional imperative, not just a technical preference.
The Road Ahead: Who Should Lead?
The question of who bears the responsibility for this migration remains a point of contention. Should WordPress Core mandate PHP 8.0+ as a minimum requirement?
Petrović acknowledges the difficulty of such a move. "If WordPress were to suddenly drop support for PHP 7.4, a significant portion of the ecosystem might ‘break’ overnight," he says. This is particularly true for older, unmaintained plugins that users rely on. However, he maintains that the community must start "moving the needle."
The Role of Third-Party Libraries
One of the most powerful drivers for change is actually coming from outside the WordPress bubble. Many modern PHP libraries that developers use to build themes and plugins are dropping support for older PHP versions. As these foundational building blocks require PHP 8.1 or 8.2, plugin developers are being forced to upgrade their own code to remain compatible with the libraries they rely on.
The Call to Action
For the average WordPress user, the path forward is clear:
- Check your environment: Log into your hosting dashboard and identify your current PHP version. If it is 7.4 or lower, it is time to upgrade.
- Consult with professionals: If you are unsure, reach out to your hosting support or a developer. Ask if your site is ready for a PHP 8.x migration.
- Adopt a culture of maintenance: View your website as a living, breathing entity that requires consistent updates—not just for WordPress and plugins, but for the server environment that powers them.
Conclusion
The transition to modern PHP is an existential necessity for the longevity of the WordPress ecosystem. While the legacy of "democratizing publishing" has served the platform well, the future of web security demands higher standards.
By leveraging the performance gains of modern PHP, adopting "secure by design" coding practices, and gradually phasing out support for EOL environments, the WordPress community can ensure it remains a safe and reliable home for the next generation of web development. As Petrović aptly summarized, the transition may be a "big puzzle," but it is one that must be solved—one update at a time.
