Introduction and Main Facts
The ongoing reliance on legacy PHP versions within the WordPress ecosystem has created a quiet, compounding crisis for millions of websites worldwide. While the WordPress platform has historically championed radical backward compatibility to lower the barrier of entry and drive mass adoption, this philosophy has introduced significant technical debt. Millions of live WordPress sites continue to run on end-of-life PHP versions—such as PHP 7.4, which reached its official end-of-life more than four years ago.
This critical security gap was a focal point of discussion at WordCamp Europe, where long-time developer and Freemius full-stack engineer Milan Petrović took the stage to address the issue. In his presentation, “Secure by Design: Hardening Plugins with PHP 8.x,” Petrović argued that writing and running legacy PHP code is no longer merely a suboptimal development habit; it serves as an active invitation for automated exploitation. Petrović pointed to startling statistics, revealing that thousands of known, confirmed bugs remain unpatched and publicly documented for legacy PHP branches like PHP 5 and PHP 7—vulnerabilities that will never receive official fixes.
Chronology and Evolution of the PHP Landscape
To understand how the WordPress ecosystem arrived at this crossroads, one must look at the historical relationship between the Content Management System (CMS) and the server-side scripting language that powers it.
- 2007–Pre-2015 (The Rise of Compatibility): WordPress cemented its dominant market share by ensuring that hosting providers did not need to invest heavily in cutting-edge server infrastructure. Backward compatibility allowed older, cheaper hosting configurations to run WordPress seamlessly, fueling unprecedented global adoption.
- 2019–2020 (The PHP 8 Milestone): PHP 8 was introduced, marking a massive architectural milestone for the language. It brought native type safety, performance optimizations, and structural changes that fundamentally shifted how secure and efficient code could be written.
- December 2022 (PHP 7.4 End-of-Life): Official security support for PHP 7.4 ceased. Despite this, millions of WordPress websites remained on the 7.x branch.
- Present Day (WordCamp Europe Discussions): Industry experts like Petrović are actively sounding the alarm. While core WordPress continues to slowly phase out ancient dependencies, a vast percentage of the active installation base remains anchored to vulnerable legacy codebases. Petrović notes that modern releases like PHP 8.5 are drastically faster and vastly more memory-efficient than their predecessors, yet migration velocity remains stagnant.
Supporting Data and Technical Realities
The debate over upgrading PHP versions is frequently framed around theoretical best practices, but empirical data reveals tangible, measurable consequences for site owners, developers, and hosting providers alike.
The Vulnerability Surface
- Thousands of Open Exploits: Research into legacy PHP versions highlights between 3,000 and 4,000 open, confirmed bug reports tied to PHP 5 and PHP 7. Because these branches are entirely unsupported, these bugs represent permanent, public vulnerabilities that automated malicious scripts continuously scan for and exploit.
- Adoption Demographics: Official WordPress hosting statistics indicate that approximately 20% of all tracked WordPress sites still rely on PHP 7.4, with a persistent tail-end of installations still lingering on PHP 5.x.
Performance and Resource Dividends
Upgrading is not solely a security imperative; it is a financial and infrastructural optimization.
- Speed Improvements: Each successive iteration of PHP 8 brings compounded performance gains. PHP 8.5, for example, executes identical codebases significantly faster than PHP 7.4 without requiring any manual code refactoring.
- Memory Reduction: Benchmarks presented by developers like Petrović demonstrate that modern PHP drops memory consumption substantially for the exact same operations. For hosting providers, this creates a compelling economic incentive: upgrading client sites frees up server resources, enabling higher density, lower overhead, and improved profit margins.
To help developers visualize these disparities, Petrović introduced the open-source Vulnerability Lab plugin on GitHub. Designed specifically to demonstrate the stark differences in runtime behavior, the tool allows developers to execute identical vulnerable code patterns across legacy and modern PHP environments—showcasing fatal errors and security bypasses on PHP 7.4 versus fully neutralized, secure execution on PHP 8.x.
Perspectives from the Ecosystem
The responsibility for modernizing the PHP stack is shared across three primary pillars of the WordPress community: core maintainers, hosting companies, and third-party plugin developers.
The Developer and Agency Perspective
For independent developers and digital agencies, modernizing codebases is increasingly driven by external factors. Modern third-party PHP libraries—used for everything from URL parsing to advanced security checks—have aggressively dropped support for legacy PHP. Developers who wish to utilize up-to-date, secure libraries are forced to raise their minimum PHP requirements to PHP 8.1 or 8.2, creating a top-down pressure gradient that overrides historical backward compatibility.
Furthermore, tools like the Vulnerability Lab plugin offer agencies a practical mechanism to communicate risk to non-technical clients. By contrasting memory consumption and demonstrating live security exploits in a staging environment, agencies can effectively justify the time and expense required to refactor outdated plugins or migrate legacy infrastructure.
The Hosting Provider Dilemma
Hosting providers occupy a delicate position. Managed hosts that proactively force PHP updates often face pushback from clients whose older, unmaintained custom plugins or legacy themes inevitably break under stricter type-checking rules. Balancing customer satisfaction with server security remains a complex puzzle. However, experts emphasize that hosting providers have the most to gain financially from forced migrations, as optimized memory footprints directly correlate with reduced infrastructure costs.
The Core WordPress Dilemma
While WordPress core maintains compatibility with newer PHP iterations, it continues to officially support outdated branches to prevent catastrophic site breakage across millions of unmaintained sites. Critics argue that this overly cautious stance inadvertently enables technical negligence, leaving site owners falsely secure in the knowledge that their ancient server environments are still technically "supported."
Implications for the Future of WordPress
The friction between universal accessibility and uncompromising security will define the trajectory of WordPress over the next decade.
- Stricter Typing and Core Modernization: If WordPress gradually phases out the PHP 7 branch as a supported baseline, core contributors will be unlocked to implement stricter typing and modern design patterns natively. This will streamline the codebase and reduce long-term maintenance overhead.
- The "Bike in the Garage" Fallacy: Many non-technical website owners treat their digital properties like static physical assets—expecting them to function indefinitely without maintenance, lubrication, or updates. As automated botnets become increasingly sophisticated at exploiting legacy PHP endpoints, this passive mindset will become economically and operationally untenable.
- Gradual Modernization as the Standard: The consensus emerging from technical tracks at events like WordCamp Europe is clear: modernization cannot happen overnight, but it cannot be indefinitely postponed either. Through incremental plugin updates, rigorous staging environment testing, and developer-focused tooling like the Vulnerability Lab, the ecosystem must transition away from supporting the lowest common denominator.
Ultimately, embracing PHP 8 and beyond is no longer just about gaining a performance edge; it is an existential defense mechanism designed to protect the global WordPress economy from automated, systemic compromise.
