Does WordPress Update PHP Automatically? No, Here Is Why

Key takeaways

• No, WordPress does not update PHP. PHP runs on your website's server. WordPress.org says your hosting company decides which PHP versions your site can use (checked 22 October 2026).
• Automatic updates are about WordPress. WordPress.org's update guide describes background updates for WordPress core and translation files, and says plugins and themes are not updated automatically in general.
• Plugin updates can be switched on, one plugin at a time. WordPress.org's plugin guide says this has been possible since WordPress 5.5. It does not touch PHP either.
• The host owns PHP, the database and the server software. You can usually ask for a change, and many hosts give you a switch in their panel.
• Check the number yourself. The PHP version is in the dashboard under Tools, Site Health, Info, Server.
• If you were relying on "auto-updates are on", check now. What fixes the October 2026 flaws is a newer PHP build on the server. Our main guide to the PHP vulnerability of October 2026 names the patched releases.

Why people think WordPress updates PHP

A WordPress dashboard is full of update notices. It tells you when core, plugins and themes have a new version, and some of that can happen with no click from you. It is easy to turn that into "my site looks after itself".

The catch is where each piece lives. WordPress, your plugins and your theme are files inside your site. PHP is different. It is the engine on the server that reads those files and builds each page. As WordPress.org explains, PHP sits on the server itself. A change therefore happens in your host's settings, or by a request to the host.

Think of a car. WordPress updating itself is like the radio updating its station list. The engine is serviced at the garage, and your host is the garage.

What updates itself and what does not

This table uses what WordPress.org says on its pages. Where a page does not cover something, the cell says so, and it does not guess.

Sources: WordPress.org developer documentation on upgrading WordPress, WordPress.org's Manage Plugins page, and WordPress.org's "Update PHP" page, all read on 22 October 2026. The database, web server and operating system rows are our reading, not a WordPress.org statement: its requirements page lists them as what WordPress needs from the server, and none of the update pages we read describe WordPress updating them.

A note on the first two rows. The WordPress.org update guide says minor core releases, meaning maintenance and security releases, update on their own by default. Your host or a plugin may change that behaviour, so the dashboard is the place to see what is true for your site.

What WordPress asks of your server

Recommended on the WordPress.org requirements page: PHP from 8.3 up, plus a database of MariaDB 10.11 or above, or MySQL 8.0 or above. It adds that your host should offer HTTPS, and that Apache or Nginx is the suggested web server.

That page also admits WordPress will still run on PHP 7.4 and on MySQL 5.5.5 or above. Both have reached end of life, though, and the page cautions that they can leave a site open to security holes. That is the trap. WordPress keeps working on an old server, and so the site looks healthy while the PHP under it is not.

For more on the minimum and the recommended versions, read what WordPress requires for PHP. Dates when each version stops getting fixes are in PHP end of life dates and what to do.

What hosts commonly do

It varies a lot, and we will not guess about any single company. Here are the patterns we can describe in general terms, and the question to ask for each.

WordPress.org mentions that a few hosts may be patching or filtering traffic on your behalf, without naming any. Want ready-made wording? Our questions to send your web host about the PHP security fix can be pasted straight into an email. Why replies differ from plan to plan is covered in our piece on managed WordPress hosting versus shared hosting.

How to check your PHP version today

1. Sign in to the WordPress dashboard.
2. Open Tools, then Site Health.
3. Click the Info tab.
4. Expand Server and read the PHP version line.
5. The php.net advisory of 21 October 2026 names the patched builds to compare against. The list reads 8.5.12 for 8.5, 8.4.27 for 8.4, 8.3.36 for 8.3 and 8.2.35 for 8.2, and anything newer within your own branch is fine too.
6. If it is lower, or the branch is 8.1 or older, ask your host to move it, and ask for written confirmation when it is done.

Locked out of the dashboard, or just want a different way in? Our walkthrough for checking your PHP version in cPanel or on the command line has both. Back up first, then follow how to check and update your PHP version on WordPress to make the switch.

What we cannot say, and where this advice stops applying

• The host could already be on it. WordPress.org notes that certain hosts could already be patching or filtering traffic. From outside we cannot tell if yours is among them, so ask.
• A version number can mislead. Some systems fix the problem and keep the old number. A matching number is a good sign, and a written reply from the host is better.
• Hosts that manage everything. On a fully managed plan, the host may update PHP for you. Then your job is only to confirm it, and the table above becomes a list of questions, not a to-do list.
• Plugin auto-updates are a trade. They keep plugins current without effort, and they can also change something on a live site with no warning. Whether to switch them on depends on how often someone checks the site. We make no blanket rule here.
• Site builders. With Webflow, Shopify, Wix, Squarespace or Framer, the servers belong to the platform, which leaves you no PHP to look after. Webflow's Trust Center post dated 21 October 2026 states that customers need not do anything. For the other four, nothing turned up on 22 October 2026, so a written answer needs a question to them. More on that platform: is Webflow secure and does it run PHP.

How we help at Amariq

Because WordPress keeps its own parts current but leaves PHP to your host, many owners discover the gap only when a headline arrives. Within a day of this advisory we moved several WordPress sites onto a patched PHP version and tested that each one still worked, which closed the gap. Where no one in your team takes that on, the WordPress PHP update gig on Fiverr can handle a one-off update for you. For ongoing care on a different platform, see our Webflow maintenance page. Anyone can read our client reviews on Fiverr and Upwork, and the YouTube channel shows how the work is done.

Frequently asked questions

Does WordPress update PHP automatically?

No. WordPress.org says PHP runs on your website's server and that your hosting company decides which PHP versions your site can use. WordPress can update itself, but it cannot change the PHP under it.

If my WordPress auto-updates are on, is my PHP safe?

Not because of that setting. That setting covers WordPress files only, while the October 2026 fix is a server-side PHP upgrade. Look up your PHP version in Site Health, then have your host confirm the fix.

Does my host update PHP for me?

It depends on the host and the plan. Some hosts give you a switch, some update on managed plans, and some leave PHP alone until you ask. Ask in writing which version you run and whether the fixed release is live.

Do WordPress plugin auto-updates also update PHP?

No. WordPress.org's plugin guide says you can enable auto-updates for individual plugins from the Plugins screen. That only updates the plugin's own files.

Where can I find my PHP version?

From the dashboard, choose Tools, then Site Health, then the Info tab, and open the Server block. WordPress.org gives this route. Plenty of hosts display it in their control panel as well.

Do I need to update MySQL as well?

On the database side, WordPress.org suggests MariaDB 10.11 or later, or MySQL 8.0 or later. The database server is run by your host. WordPress does not update it for you. Since the October 2026 flaws sit in PHP, PHP is the urgent part, and the database is something to raise with your host.

Can I update PHP myself?

Often yes, if your host offers a version switch in its panel. If not, your host can do it for you. Back up the site first, update WordPress, plugins and themes, and test afterwards.

Does this matter if my site is on Webflow?

Webflow operates its own servers, and a Trust Center post from 21 October 2026 tells customers there is nothing to do. There is no PHP of yours to update there. This guide is for sites that run PHP, such as WordPress.