Website Security

Hire Someone to Update PHP on WordPress: What to Check Before You Pay

After the PHP security fixes of 21 October 2026, many site owners cannot update PHP themselves and are looking for help. This guide shows when hiring makes sense, what a safe job contains, which signs should make you walk away, and what to ask. Sources read 22 October 2026.

Hire Someone to Update PHP on WordPress: What to Check Before You Pay

Key takeaways

  • Hire for the testing, not the switch. Changing the PHP number takes minutes in most host panels. The value of a professional is the backup before it, the checks after it, and the repairs in between.
  • A safe job leaves proof. Ask for your PHP version before and after, plus a note of what was tested. A vague "done" is not proof.
  • Never send a password in chat. A proper helper asks for an admin invite on your WordPress site and, where needed, access to your host panel.
  • Old PHP makes the job bigger. The PHP project no longer updates 8.1 and older, so a site on PHP 7 usually has older plugins and themes that need checking too.
  • Your host may already do part of it. WordPress.org says hosts may be updating PHP and adding firewall rules, so ask your host before you pay anyone.
  • A hacked site is a different job. Updating PHP does not clean up a site that was already compromised, and a good provider tells you so before you order.

Do you need to hire anyone?

Not always. Match your situation to the right route first.

Your situationBest first move
Your host shows a PHP switch and you are comfortable with backupsDo it yourself, using our guide to updating PHP on WordPress
Your host runs everything for you (managed hosting)Ask the host for written confirmation, as covered in who patches PHP
You run a shop or take bookingsHire, because a broken checkout costs more than the fee
You do not know your PHP version, or it looks like 7.xHire, since old PHP often means old plugins as well
You manage client sites as an agencyHire or partner, because several sites at once is a scheduling problem

The news behind all this is covered in our main PHP guide: two critical flaws, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per php.net.

What a safe PHP update job includes

WordPress.org's own advice for a PHP change is to back up, update everything first, check compatibility and contact your host if unsure. A paid job should cover at least that, and more.

StepWhy it mattersWhat you should receive
Full backup of files and databaseGives you a way back if a plugin failsA note that the backup exists and where it is stored
Update WordPress, themes and plugins firstOld code is the usual cause of breaksA list of what was updated
Compatibility check of plugins and themeFinds problems before visitors doA list of anything flagged
PHP switch, ideally on a staging copy firstKeeps the live site safe while testingThe new version number
Fix or replace what breaksThe switch alone can leave a broken pageA note of each repair
Test pages, forms, login, admin and checkoutThese fail quietly, so someone must click themA short test list
Host confirmation of the security fixA version label can mislead when a vendor backports a fixThe host's written answer
Before and after reportIt is your record, and your own clients may want itOne page with both PHP versions

Signs you should look elsewhere

These are judgment calls, not rules from any standard, but each one is a reason to pause.

  • They ask you to send a login password in a message.
  • They promise a result with no risk, or say nothing can go wrong.
  • They will not take a backup first, or do not mention one.
  • They cannot say which PHP version they will move you to, or why.
  • They plan to change PHP and update every plugin in the same minute, with no testing in between.
  • They say your site is "definitely hacked" with nothing to show, or the reverse, "definitely safe".
  • There is no way to reach them after the job if something breaks a day later.

Questions to ask before you hire

Paste these into a message. A good provider answers each one in plain words.

Hello, I want my WordPress site moved to a supported PHP version after the 21 October 2026 security release. 1. Which PHP version will you move me to, and what if my host does not offer it? 2. Do you take a full backup first, and how do I restore it? 3. Will you test on a staging copy, or on the live site? 4. What do you test afterwards, and do I get a list? 5. What happens if a plugin stops working? 6. What do you need from me, and how will I give you access safely? 7. Will you send a before and after report?

What decides how long the job takes

Page count matters less than people expect. These things set the time:

FactorEffect
The jump in PHP versionsA move from 7.4 to 8.3 is a bigger leap than 8.1 to 8.3, so more can break
Age of plugins and themeAbandoned plugins may need replacing
A shop or booking systemCheckout and payments need extra testing
Host accessA host that offers staging and a PHP switch saves time
A recent backupIf none exists, creating one is the first task
Signs of a past hackThis becomes cleanup work and is quoted separately

What to prepare

  • Your site address and the name of your host.
  • A WordPress administrator invite for the helper.
  • A way to reach your host's panel, or the host's support details.
  • A recent full backup, if you already have one.
  • A short list of what must keep working, such as a booking form or a shop.

How we help

At Amariq, we offer this as a fixed-scope service on Fiverr. You can order the WordPress PHP update gig by site size, with extras for online shops, staging tests and written host confirmation. For every site we take a full backup first, update WordPress, plugins and theme, move PHP to 8.3 or newer where your host offers it, fix what breaks, test the main pages, forms, login and admin, and send a short before and after report. We ask for an administrator invite, never a password in chat, and your domain, hosting and analytics accounts stay in your name. A site that was already hacked, or one built on abandoned plugins, is quoted separately, and we say so before you order. If you would rather leave PHP behind altogether, Webflow migration moves a WordPress site across with its URLs, and our WordPress development page covers ongoing work. Our guide to website maintenance costs shows where this sits in a yearly budget.

Frequently asked questions

Can I update PHP on my WordPress site myself?

Often yes. If your host gives you a PHP setting and you take a backup first, WordPress.org describes the steps. Hire help if you run a shop, do not know your PHP version, or would rather not risk the site breaking.

How do I know the update was done properly?

Check Site Health in WordPress, under Info and Server, for the PHP version. Then ask your host to confirm the security fix in writing, because a vendor can fix a flaw and keep the old version number. Our guide to what to ask your host lists the questions.

Will updating PHP delete my content?

No. Your pages and settings live in the database, and a PHP change does not alter them. A broken plugin can still make pages show errors, which is why a backup comes first.

What if my host does not offer the PHP version I want?

A good provider moves you to the newest version your host supports and tells you so. If the host only offers old versions, the honest advice may be to change host.

Can the same person clean up a hacked site?

Sometimes, but it is a different job. The NCSC advises checking for signs of compromise and backdoors if you stayed exposed, and that takes more than a version change. Say so before you order, so the work is scoped correctly.

Is a Fiverr gig a safe way to hire?

It can be, as long as you judge the seller the way you would anyone else. Read what each package includes, use the questions above, and avoid anyone who asks for passwords in a message. Fiverr publishes its own buyer rules on its site, so read those before you order.

Do I need to update WordPress as well?

WordPress.org says no WordPress update is required or planned for these flaws. Updating WordPress, plugins and theme before the PHP change is still good practice, because it removes known problems before you switch.

Rahat Khondokar, founder of Amariq

Rahat Khondokar

Founder & CEO, Amariq

Rahat designs and builds websites for marketing teams and ecommerce brands, and writes here about the structure, copy and conversion work behind them. More about Amariq. Find him on YouTube, Dribbble and LinkedIn.

Keep reading

Related articles.

All articles