For millions of WordPress users, the digital infrastructure powering their websites is a "black box." It is an unseen engine that hums along in the background, generally ignored until a critical error occurs or a security breach makes headlines. However, beneath the hood of this massive ecosystem lies a fundamental component that is increasingly becoming a liability: PHP.
At the recent WordCamp Europe, Milan Petrović, a veteran developer and full-stack engineer at Freemius, delivered a sobering wake-up call to the WordPress community. His presentation, "Secure by Design: Hardening Plugins with PHP 8.x," argued that the community’s long-standing attachment to legacy PHP versions is no longer a mere preference for compatibility—it is an "active invitation for automated exploitation."
The Core Issue: A Legacy Burden
WordPress was built on the foundation of radical backwards compatibility. This philosophy, while arguably responsible for the platform’s meteoric rise to powering over 40% of the web, has created a paradoxical security environment. By supporting older, end-of-life (EOL) versions of PHP, WordPress has inadvertently allowed a significant portion of its user base to operate on platforms that are fundamentally unsafe.
Petrović notes that while many users see PHP version numbers in their hosting control panels, there is a lack of widespread understanding regarding the security and performance implications of these versions. "We are running now maybe six years behind end-of-life PHP versions," Petrović explained. "PHP 7.4 reached its end of life four and a half years ago, yet we still support it in the WordPress Core."
Chronology of an EOL Crisis
The lifecycle of a programming language is designed to ensure stability and security. When a version reaches "End of Life," the official maintainers cease providing security patches. This leaves any system running that version permanently vulnerable to any new exploits discovered after that date.
- The PHP 5/7 Legacy: Despite being years out of support, millions of WordPress sites continue to operate on PHP 7.x and even PHP 5.x.
- The Security Void: Research indicates there are between 3,000 and 4,000 open, confirmed, and unpatched bug reports for these legacy versions. These are not obscure glitches; they are documented security vulnerabilities that are now part of the public record—meaning hackers know exactly how to exploit them.
- The 2024 Reality: As of this year, a significant percentage of the WordPress ecosystem remains stuck on versions that have not seen an official security update in years. This creates a predictable, static target for automated botnets and malicious actors scanning the web for low-hanging fruit.
Supporting Data: The Cost of Stagnation
The argument for upgrading is not purely based on fear; it is also based on measurable, tangible gains. Petrović’s research into the performance benefits of modern PHP is compelling, particularly for hosting companies and agency owners looking to optimize resources.
Performance and Memory Efficiency
Modern versions of PHP, particularly the 8.x branch, are significantly more efficient than their predecessors. Petrović highlights that PHP 8.5 is projected to be more than 50% faster than PHP 7.4. Furthermore, the memory footprint required to execute the same volume of code is drastically reduced in newer versions. For hosting providers managing tens of thousands of sites, this represents a massive opportunity to lower infrastructure costs and increase server density—yet, the inertia remains.
The "Bike" Analogy
In his discussion with WP Tavern’s Nathan Wrigley, Petrović addressed the common "set it and forget it" mentality of many website owners. Comparing a website to a bicycle, he noted: "You need to maintain your bike. If you don’t do it, the chain will rust, and the wheels will deflate. A lot of things can happen if you don’t maintain it." The misconception that a website is a static commodity is, according to Petrović, one of the biggest hurdles to adoption.
Official Stance and The Developer Dilemma
Why hasn’t the WordPress community forced a hard cutoff? The answer lies in the massive, diverse nature of the ecosystem. Millions of non-technical users, small business owners, and legacy plugin developers rely on the current status quo.
The Risk of Breaking Change
A sudden requirement for PHP 8.x would undoubtedly "break" thousands of legacy plugins and themes that have not been updated by their original developers in years. For an agency owner, this presents a nightmare scenario: a client’s site, which functioned perfectly yesterday, is suddenly taken offline by a mandatory server update.
The "Vulnerability Lab" Initiative
To bridge the gap between technical reality and user understanding, Petrović introduced the "Vulnerability Lab" plugin. This tool is designed to allow developers to see firsthand how code exploits—such as authentication bypass or server-side request forgery—behave across different PHP versions. By running the same code on PHP 7.4 versus PHP 8.x, the plugin provides a clear, visual demonstration of how modern PHP acts as a "native shield," neutralizing threats that would otherwise be fatal on legacy systems.
Implications: A Path Forward
Moving toward a more secure future does not require an overnight, disruptive overhaul. Instead, Petrović proposes a multi-pronged approach that the community can adopt:
1. Gradual Modernization for Developers
Developers are encouraged to adopt a policy of "modernization by default." By setting a minimum PHP requirement of 8.0 or higher for new plugins, developers can slowly force the ecosystem to mature. Small, incremental changes—such as implementing strict typing—can be integrated into ongoing maintenance cycles rather than requiring massive refactoring projects.
2. Hosting Companies as Agents of Change
Managed hosting providers have the most significant leverage in this process. By enforcing server-side upgrades and providing clear, actionable paths for users to transition their sites, hosts can drastically reduce the attack surface of the entire WordPress ecosystem. While this involves support costs and the risk of client friction, the performance and security benefits provide a clear ROI.
3. Third-Party Library Dependencies
The broader PHP ecosystem is already moving faster than WordPress. Many modern PHP libraries now require 8.1 or 8.2, effectively forcing developers to upgrade their environments to remain compatible with the latest tools. This "forced migration" is a powerful, if involuntary, driver of progress.
Conclusion: The Responsibility of the Ecosystem
The conversation between Milan Petrović and Nathan Wrigley serves as a critical reminder that WordPress is not just software; it is a community-driven, ever-evolving project that relies on the participation of its users to remain secure.
The era of "set it and forget it" is over. As automated exploits become more sophisticated, the continued reliance on legacy PHP versions is no longer a neutral choice. Whether you are an agency owner, a developer, or a casual site user, the message is clear: the path to a secure, high-performance future lies in the active, deliberate embrace of modern PHP. By upgrading, we do not just protect our own sites; we raise the baseline security for the millions of people who depend on the WordPress ecosystem every day.
For those looking to start, the first step is simple: check your current PHP version, consult your host, and begin the transition. The tools to secure our future are already here; we simply need to use them.
