Introduction and Main Facts
The WordPress ecosystem stands at a critical crossroads. While millions of small business owners, bloggers, and agencies rely on the popular Content Management System (CMS) for its legendary ease of use, a silent technical deficit threatens the stability and security of the entire platform.
During a recent appearance on the WP Tavern Jukebox Podcast, developer and Freemius full-stack engineer Milan Petrović outlined the existential risks tied to running WordPress on outdated versions of PHP—the foundational programming language powering over 40% of the top 10 million websites. Petrović’s insights, stemming from his widely attended WordCamp Europe presentation titled "Secure by Design: Hardening Plugins with PHP 8.x," emphasize that relying on legacy PHP code is no longer a benign practice. Instead, it serves as an active invitation for automated, large-scale cyberexploitation.
The core issue centers on a massive disparity between modern software capabilities and the legacy systems still in active production. According to Petrović, thousands of open, unpatched bug reports exist for legacy PHP branches like PHP 5 and PHP 7—versions that reached their official "end-of-life" years ago. Despite PHP 7.4 hitting its end-of-life milestone more than four years ago, it continues to power roughly 20% of all tracked WordPress installations.
To bridge the gap between abstract security warnings and real-world vulnerabilities, Petrović developed the Vulnerability Lab plugin. Designed as an educational tool for developers and agencies, the plugin demonstrates how identical code executes successfully under modern PHP environments while triggering fatal errors or falling victim to exploits on legacy setups.
Chronology of an Ecosystem Dilemma
To understand how the WordPress community arrived at this precarious state, it is necessary to examine the historical trajectory of the platform’s relationship with PHP.
2007–2020: The Era of Backward Compatibility
When Milan Petrović began developing WordPress plugins in 2007, the primary objective for the CMS was rapid adoption and widespread accessibility. To achieve this, WordPress core developers championed a strict backward-compatibility policy. This philosophy ensured that website owners did not need to upgrade their server environments annually, which in turn allowed budget hosting providers to deliver cheap, reliable WordPress hosting without investing in modern server infrastructure.
While this strategy fueled WordPress’s astronomical growth, it inadvertently trapped both the core software and its vast plugin repository in a perpetual time loop, shackled to the lowest common denominator of hosting capabilities.
December 2020: The Release of PHP 8.0
The release of PHP 8.0 marked a monumental milestone for web development. It introduced strict typing, constructor property promotion, union types, and an array of native performance enhancements. However, because millions of legacy WordPress sites relied on older configurations, core adoption of PHP 8 requirements proceeded at a sluggish pace.
2024–2026: The Freemius Era and Current Landscape
By the time Petrović joined Freemius as a full-stack developer in 2024, the security landscape had drastically shifted. Automated botnets began actively weaponizing known vulnerabilities in legacy software stacks. At WordCamp Europe, Petrović delivered his landmark talk, aiming to drag the conversation out of the shadows and force a reckoning among hosting providers, core maintainers, and individual developers alike.
Supporting Data and Technical Metrics
The debate over upgrading PHP versions is frequently framed as a developer’s preference, but cold statistics tell a compelling story of security, efficiency, and resource management.
- The 20% Legacy Holdout: Official WordPress telemetry indicates that approximately 20% of active installations still operate on the defunct PHP 7.4 branch, with a stubborn percentage of sites lingering on PHP 5.x.
- Thousands of Open Vulnerabilities: Research into legacy PHP builds reveals between 3,000 and 4,000 confirmed, unpatched bug reports. Because these PHP branches are unsupported, these bugs will never receive official security patches.
- Performance Gains: Modern PHP upgrades offer compounded efficiency. PHP 8.5 operates more than 50% faster than PHP 7.4.
- Memory Optimization: Benchmarks demonstrated by Petrović indicate that newer PHP versions execute identical blocks of code using nearly half the memory required by legacy versions.
These metrics highlight a paradox: hosting companies and users who resist upgrades under the guise of cost-saving or stability are actually squandering server resources. Upgrading to modern PHP natively frees up computing power, allowing servers to host more sites efficiently while simultaneously slamming the door on thousands of documented exploits.
Official Responses and Ecosystem Perspectives
The tension between maintaining universal accessibility and enforcing rigorous security standards has sparked intense debate among core developers, hosting providers, and independent plugin authors.
The WordPress Core Dilemma
WordPress maintains a delicate balancing act. On one hand, core maintainers strive to keep the platform accessible to non-technical users who may not know how to log into a hosting control panel and change a PHP version. On the other hand, supporting legacy environments forces core developers to write backward-compatible code, limiting their ability to implement strict typing and modern programming patterns.
Hosting Providers Caught in the Middle
Hosting companies face unique operational risks when pushing automated PHP upgrades. If a host forces users from PHP 7.4 to PHP 8.2, long-abandoned plugins on client websites may break, resulting in white screens of death and an influx of panicked support tickets. Consequently, budget hosts often prioritize keeping legacy sites "working" over enforcing mandatory security upgrades. Conversely, managed WordPress hosts have begun proactively phasing out outdated PHP versions, shielding non-technical users from their own technical debt.
The Influence of Third-Party Libraries
Outside the immediate WordPress bubble, the broader PHP development community moves at a much faster pace. Independent package maintainers—who build libraries for URL parsing, data sanitization, and security—frequently drop support for older PHP versions to leverage modern language features. Consequently, WordPress plugin developers who rely on these third-party packages are increasingly forced by external dependencies to update their minimum PHP requirements, regardless of whether WordPress core has caught up.
Implications for Developers, Agencies, and Users
The transition away from legacy PHP carries distinct, actionable implications for every stakeholder in the WordPress space.
For Plugin and Theme Developers
Developers can no longer treat minimum PHP version requirements as an afterthought. Writing legacy PHP 7 code is an active vulnerability liability. By establishing a clear policy—such as setting PHP 8.0 as a strict minimum baseline, as Petrović has done with his Dev4Press plugins—developers can systematically refactor their codebases. Tools like the Vulnerability Lab plugin serve as practical testing grounds, allowing developers to visually demonstrate to clients why code that "works" on PHP 7.4 is actually a ticking time bomb.
For Digital Agencies
Agencies face a communication challenge when dealing with clients wedded to outdated, unmaintained software. Tools that visually and quantitatively demonstrate the performance degradation and security risks of legacy PHP provide agencies with the leverage needed to pitch modernization projects. Upgrading a client site from PHP 7.4 to PHP 8.x is no longer just a routine maintenance task; it is a vital risk-mitigation strategy.
For Everyday WordPress Users
Non-technical users must shift their mental model of a website away from the "static bicycle in the garage" analogy. A WordPress site is a living, breathing digital asset that requires regular maintenance, updates, and a secure server environment. While dashboard notifications about PHP versions can feel intimidating, ignoring them exposes websites to automated, indiscriminate attacks that harvest data and compromise server integrity.
Conclusion
The message from Milan Petrović’s work and his WordCamp Europe presentation is clear: the WordPress community must accelerate its migration away from legacy PHP. While backward compatibility built the foundation of WordPress’s massive market share, clinging to unsupported software now threatens its future.
By combining the robust native security shields of modern PHP with WordPress’s core sanitization practices, developers can build products that are truly secure by design. Whether through gradual code updates, proactive hosting policies, or utilizing educational tools like the Vulnerability Lab, the path forward requires a collective commitment to modernizing the web—one update, one plugin, and one server at a time.
