Does Updating WordPress Update PHP? How WordPress, Plugins and PHP Fit Together

The answer

WordPress is written in PHP. Every time someone loads a page, the web server hands the request to PHP, and PHP runs WordPress’s code. Updating WordPress replaces WordPress’s files; it does not touch the PHP software that runs them. That is why, when PHP released fixes for two critical vulnerabilities on October 21, 2026, WordPress said “no WordPress update is required or planned for these issues” and encouraged site owners to update PHP (WordPress.org). Details of that release are in the October 2026 PHP security release.

Who updates WordPress, plugins and PHP?

You or your developer update WordPress, plugins and themes; your host or server administrator updates PHP. A WordPress site has four layers, and only one of them is PHP.

Where can you see your PHP version in WordPress?

In the WordPress dashboard, open Tools → Site Health → Info and expand Server. It shows the PHP version WordPress is running under, which is the web runtime rather than the command line (WordPress documentation). WordPress also shows a notice in the dashboard when your PHP version is older than it recommends.

Your hosting control panel usually has a PHP version or PHP settings screen too. Neither place tells you whether your host’s build includes a particular security fix, because hosts often patch older-numbered builds. Our patch status guide explains what to ask instead.

What does your host do that WordPress cannot?

On most WordPress hosting, the host does three things you cannot do from the dashboard:

• installs patched PHP builds when security fixes are released, and restarts PHP so the site uses them;
• decides which PHP branches you can choose, and when old ones are removed;
• may add firewall rules at the server or network level during an incident.

Some hosts let you switch your site to a newer PHP branch in the control panel. That switch is a PHP upgrade, which is a bigger change than a security patch within the same branch, and it is where compatibility testing earns its keep.

Can a PHP update break WordPress plugins?

It can, mostly when moving to a new PHP branch rather than applying a patch within one. WordPress core supports a range of PHP versions, listed on WordPress’s PHP compatibility reference. Your plugins and theme are the less predictable part. Each one sets its own minimum PHP version, and plugins that are no longer maintained may never have been tested on newer branches. When a newer PHP removes or tightens something an old plugin relies on, the result is usually a white screen, a failed form or an error during checkout.

Testing on a staging copy first, with a current backup, catches most of this before customers do. For sites where an upgrade is overdue, see PHP version upgrades.

Do up-to-date plugins mean PHP is patched?

No. It is easy to see “everything is up to date” in the dashboard and assume the site is patched. That message covers WordPress, plugins and themes only. A security plugin runs inside PHP, so it cannot replace a vulnerable PHP runtime; the most it can do is report the PHP version or add firewall rules. Firewall rules can reduce exposure, but for the October 2026 vulnerabilities PHP says updating is the only complete fix.

What should a WooCommerce store test after a PHP change?

Test a complete order, the emails, the integrations and scheduled tasks. Stores have more to lose from a failed change, so before and after any PHP change, check:

• a test order completes through the payment gateway, including the confirmation page;
• order and customer emails send;
• payment and shipping webhooks and integrations still respond;
• scheduled tasks such as subscription renewals still run;
• account login, password reset and the cart work for a logged-in customer.

In what order should you update?

1. Note the PHP version in Site Health and take a fresh backup you know you can restore.
2. Update WordPress, plugins and themes first, on staging if you have one, so they are on versions that support newer PHP.
3. Ask your host to confirm the security patch status of the PHP build serving the site, using the questions in our patch status guide.
4. If a PHP branch change is needed, test it on staging, then switch the live site in a quiet window.
5. Run the checks above straight after the change, and keep an eye on error logs for a few days.

Common questions