Managed WordPress Hosting vs Shared Hosting: Who Patches PHP?

Key takeaways

• The answer depends on the plan, not the brand. On some plans the host moves PHP for you, on others you pick the version yourself, and on a VPS it is usually your job.
• Read what each host says. The four host pages we read describe three different arrangements, set out below with the date we read them.
• "Managed" does not mean the same thing everywhere. Ask exactly what is automatic and what is left to you.
• WordPress.org's advice still applies. It says hosts may be updating PHP already, and that owners should check the version anyway.
• This is not a ranking. We compare how plans work, not which host is best.

The short version

PHP runs on the server, so the host controls the server. What differs is how much of that control you are handed. In the news post on the PHP vulnerability of October 2026 we cover the flaws themselves. Here we only ask who acts.

WordPress.org's hosting page does not say who is responsible for updates. It lists keeping system software up to date among its criteria for hosts it features, and links to its requirements page. That page recommends PHP 8.3 or newer and says older versions still work but are end of life and can expose your site to risk. WordPress.On 21 October 2026, WordPress.org noted that some hosts may already be patching PHP or filtering requests at the network edge, but told owners to verify for themselves. So the plan type is the first thing to find out.

Who updates PHP, by hosting type

This table is general. The first three rows describe how these plan types commonly work, and the host quotes further down show how real plans differ. Your own plan terms win over anything here.

If you have a VPS or cloud server and no one is named as the admin, that is the finding. Someone needs to own it.

What four hosts say on their own pages

These are paraphrases of help pages we read on 22 October 2026. Host pages change, so treat them as a snapshot and check the current page for your plan.

Three patterns stand out. Kinsta and WP Engine describe the host moving you at end of life, with Kinsta letting you switch that off and WP Engine saying it cannot be deferred. Hostinger and Bluehost describe you choosing a version in a panel, with old versions retired or marked deprecated. None of the four pages we read said anything about the October 2026 advisory, and we did not look for host announcements about it. Ask your own host directly.

We did not read pages for every host. We tried others and could not open their help pages on the day, so they are not covered here.

Why the arrangement matters for a security fix

Take a critical PHP flaw and the plan types behave differently.

• Automatic update plans. The host may roll out the fix to your site for you. You still need to confirm it, because a deadline or a setting may have kept you on an older version.
• Plans where you pick the version. Nothing changes until you open the panel and choose a patched version. If you never log in to hosting, the site can sit on an old version for years.
• Your own server. Updates are yours or your admin's, and no one will do them for you unless you arranged it.

php.net says the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that PHP 8.1 and older no longer get updates from the PHP project. So the version number alone does not settle it. It can also hide a backport, as php.net says Linux distributions and long-term support vendors received patches in advance. That is why the question to ask is the one in our guide to what to ask your web host about the PHP security fix.

Questions to ask before you choose or renew

1. Who updates PHP on this plan, and is it automatic?
2. What happens when my PHP version reaches end of life, and how much notice do I get?
3. Can I test a new version before it goes live, for example on a staging copy?
4. Can I roll back if a plugin breaks?
5. How fast did you respond to the last critical PHP or server fix, and how do you tell customers?
6. Is a web application firewall included, and does it replace updating PHP? It does not. WordPress.org still tells owners to update. If you want the detail, see our post on whether a WAF replaces PHP updates.
7. Who is on call if something goes wrong on a weekend?

How to find your PHP version

WordPress shows its PHP version in the Info tab of Site Health, in the Server block. Our step-by-step guide to checking and updating PHP on WordPress covers the control panel and command line routes. If you want one place that compares them, see how to check your PHP version.

Cost and trade-offs

More automatic care usually costs more per month, and a plain shared plan usually costs less. We do not quote host prices here because plans change. If you are weighing the monthly cost of hosting against updates and support, our guide to website maintenance costs sets those bills side by side. If your site also needs a rebuild, what a WordPress site costs is a good next read.

How we help

If you are not sure what your plan covers, we can read the plan terms with you and draft the message to your host. We build and look after WordPress sites, and if you would rather not think about PHP at all, a move through Webflow migration puts the site on a platform with no PHP version for you to manage. Once we are paid in full, you own the design, copy and code, and the accounts for your domain, hosting and analytics stay in your name.

Frequently asked questions

Does shared hosting update PHP for me?

Not always. Some shared hosts let you pick the version in a control panel, as the Hostinger and Bluehost pages we read describe, and retire old versions over time. Check your plan, and ask what happens if you stay on an older version.

Is managed WordPress hosting always safer for PHP?

Not automatically. The two managed hosts we read both describe automatic moves at end of life, but one lets you switch that off. A managed plan can still leave you on an older version if you choose a long-term support option, so read the settings.

Who patches PHP on a VPS?

Generally you or your server admin, since you rent the server. Bluehost's page says VPS and dedicated servers follow different steps from shared hosting. Ask who the named admin is and whether patching is part of the price.

What should I do if my host has not mentioned the October 2026 PHP fix?

Ask. WordPress.WordPress.org's notice leaves the final check with the owner, even where a host is already patching. Use the version screen in Site Health and send your host a short, specific message.

Do Webflow, Shopify and Wix sites need a PHP update?

Hosted builders run the servers, so there is no PHP version in your control panel. Webflow's Trust Center notice of 21 October 2026 says its core services are not built on PHP, while Shopify, Wix, Squarespace and Framer had nothing we could find on 22 October 2026. Our post on whether Webflow is secure and runs PHP goes further.

Can I move host without breaking my site?

Yes, with a plan. Back up the site, copy it, test it, and switch DNS only when it works. Keep the old plan until you are sure. A professional can do this with you if you are not comfortable.

Which host should I choose?

We do not rank hosts. Compare plans on who patches PHP, how much notice you get, how testing and rollback work, and what support covers. Our guide on how to choose a web design agency uses the same approach: ask clear questions, then compare the answers.