Planning a PHP Update: Host Patch, Upgrade or Escalate?

Patch, upgrade or escalate?

Find the row that matches your situation. The right-hand column is our practical recommendation; the facts behind it are in the October 2026 advisory guide.

When has your host already covered it?

When the host confirms three things in writing: which PHP build serves your site, that this build includes the fix, and that PHP was restarted afterward. Linux distributions received the October 2026 fixes in advance, and many managed hosts patch for their customers, so this is common. What a host usually does not do is check that your plugins, theme and custom code still work after a PHP branch change; that compatibility work is the site owner’s. The exact questions are in how to check whether a PHP security update was applied.

What should a professional PHP update include?

Whoever does the work, a well-run PHP update should give you:

• a written scope, agreed before anything changes;
• an inventory of the PHP build, SAPI, host and application components;
• a confirmed backup and a plan for what happens if the change misbehaves;
• compatibility checks proportionate to the version change;
• confirmation that the patched build is the one serving requests after a restart;
• the agreed business functions tested before and after;
• a written summary that says what was verified and what was not.

Be wary of anyone who promises a site is now “secure” or guarantees zero downtime. Neither can be honestly promised.

How do you plan a PHP update for a WooCommerce store?

Test on a copy first and change the live store in a quiet window:

1. Note the PHP version in Site Health, list active plugins and the payment and shipping integrations.
2. Take a fresh backup and confirm it can be restored.
3. Update WooCommerce, extensions and the theme on staging, then switch staging to the target PHP.
4. Run a test order end to end, check order emails, webhooks and scheduled actions such as renewals.
5. Schedule the live change outside your busiest hours, repeat the checks immediately, and watch error logs for a few days.

More on the WordPress side in does updating WordPress update PHP?

What if an older application cannot upgrade yet?

Find a patched build for the branch it runs on, or limit who can reach it, while a durable fix is planned. PHP 8.1 and older get no releases from the PHP project, but there are still options:

For unpatchable internet-facing systems, the Canadian Centre for Cyber Security suggests isolating them from public networks until a fix is applied (AL26-026). Branch support dates are on php.net.

What affects the scope and cost?

A handful of facts decide most of the effort. We do not publish fixed prices, because these vary so much between sites; this is what any quote should be based on:

How do you verify a completed PHP update?

Check the runtime and the business separately:

1. The package or build serving web requests matches the vendor’s fixed version, confirmed after a PHP restart.
2. The command-line version is not used as evidence for the website.
3. Every function on your must-not-break list was tested after the change, and the results are written down.
4. The summary says what was not covered, such as whether the site was compromised before the patch.

How can agencies coordinate many sites?

Start with one inventory, not one ticket per site. List every site with its host, PHP branch and build, who controls the server, and how important the site is to the client. Then sort: sites on unsupported branches and sites where you control the server first, managed-hosting sites where you only need written confirmation next. Track each site’s confirmation and test results in the same sheet so you can report to clients.

Scoping worksheet

Fill in what you know; “unknown” is a useful answer too. It is the same information we ask for when scoping.

Compatibility testing checklist

Run the items that apply before and after the change, and keep the results:

For moves across PHP branches, see PHP version upgrades.

Common questions