PHP 8.3 vs 8.4 vs 8.5: Which Version for WordPress?

Key takeaways

• Any of 8.3, 8.4 or 8.5 is a sound choice, as long as it is the fixed release. The fixes named in the php.net advisory dated 21 October 2026 are 8.3.36, 8.4.27 and 8.5.12. The patch number matters as much as the branch.
• WordPress.org recommends PHP 8.3 or greater. It does not name one branch above the others. Its requirements page was checked on 22 October 2026.
• 8.4 is the middle road for most sites. It has more years of support than 8.3 and has been around since November 2024, so more plugins have had time to catch up.
• 8.5 gives the longest support, but plugin readiness is the question. WordPress.org's compatibility table marks recent WordPress versions as compatible with 8.5. That table covers WordPress itself, not your plugins or theme.
• Do not pick a branch that is about to run out. Per php.net, 8.2 stops receiving security support on 31 December 2026.
• The safest branch is the newest one your whole site has been tested on. That is a test result, not a guess, and it takes a backup and an hour of clicking around.

Want the background on the flaws before choosing? Our main guide to the PHP vulnerability of October 2026 covers it. This post is about the next step: which version to move to.

The branches side by side

We built the table from three sources, all read on 22 October 2026: the supported versions page and the 21 October 2026 security advisory, both on php.net, plus WordPress.org. The support dates are written as php.net states them.

php.net's own wording is that each branch gets two years of active support and then two more years of security fixes only. Older branches, 8.1 and below, are covered in our post on PHP end of life dates, which keeps this page from repeating that table.

One point to read slowly. "Active support has ended" for 8.3 does not mean it is unsafe. It means the branch only gets security fixes now, and it keeps getting those until the end of 2027. The October 2026 fix for 8.3 is proof that security releases still arrive.

What WordPress.org says about each branch

On its requirements page, WordPress.org says hosts should support PHP version 8.3 or greater. The same page adds that WordPress runs on PHP 7.4 and up, yet cautions that the older versions are at end of life and could leave your site open to security problems.

The more detailed page is WordPress's PHP compatibility table for core versions. We read it on 22 October 2026 and it shows a last change date of 19 August 2026. Put simply:

Three plain notes on reading it.

1. It covers WordPress core only. It says nothing about your theme, your page builder or your plugins. Those are the usual cause of trouble after a PHP change.
2. A "No" on a row is a reason to update WordPress first. If your site runs WordPress 6.6, the table does not mark 8.4 or 8.5 as compatible, so update WordPress before you move PHP up.
3. The older "beta support" label has been retired. The page says so, and it notes that the label was dropped in May 2026. Do not go looking for a "beta" flag on a branch.

Plugin and theme readiness: what we can and cannot say

We could not find an official page today that lists how many WordPress plugins work on each PHP branch, so we do not give a figure. What can be said without one:

• Newer branches are newer to plugin authors. 8.5 was released on 20 November 2025, 8.4 on 21 November 2024 and 8.3 on 23 November 2023, all dates from php.net. A branch that has been out longer has simply had more time to be tested by plugin authors.
• Old or unmaintained plugins are the common weak point. Code in a plugin left without updates for years may be refused by newer PHP versions.
• WordPress.org's guide suggests the PHP Compatibility Checker plugin before a change. It also says that the plugin is not perfect, so it is a first look and not a promise.
• The only proof is a test. For the backup, the test list and the rollback steps, use our post on checking and updating PHP on WordPress.

A simple way to choose

Answer these in order and stop at the first one that fits.

1. Is your PHP older than the fixed release for its branch? Update to that fixed release first, staying on the branch you have. Then plan any branch change as a second step.
2. Are you on 8.1 or older? Move to a supported branch. There is no official fix for these. Our guide to what WordPress requires explains the minimum.
3. Is your WordPress older than 6.9? Update WordPress, then consider 8.5. For 6.7 and 6.8 the table above stops at 8.4, and for 6.6 it stops at 8.3.
4. Do you run a shop, a membership site or many plugins? Choose 8.3 or 8.4 and test on a copy of the site. Your risk comes from the plugins more than from the branch.
5. Is the site small, with a few well kept plugins? Either 8.4 or 8.5 is a fair choice after you have tested the main pages, forms, login and admin.
6. Does your host offer only one of these? Take the newest fixed release it offers. Put the question to them in writing, with help from our questions to ask your web host.

Shop owners can read WooCommerce and the PHP flaw for the checkout angle.

Gaps in what we know, and cases where this guide fits poorly

• Not every branch may be on your host's menu. Hosting companies roll out new branches when they choose to. Some may offer 8.3 and 8.4 only. That is fine. Pick the best fixed one on the list.
• Some hosts backport fixes. A Linux host can fix the flaw and keep an old version number. The version string alone cannot prove you are safe. Ask the host to confirm.
• We could not see plugin figures. Without an official list, no one can promise your exact plugins will run on 8.5. Test them.
• The dates can change. The support dates above are as php.net states them on 22 October 2026. Check the page again before a big decision. Future updates will raise each fixed release number again, so read 8.3.36, 8.4.27 and 8.5.12 as a floor rather than a goal.
• This advice does not fit a site with no PHP. With a static site or a hosted builder, there is no PHP version for you to pick. Our guide on whether Webflow runs PHP explains why.
• A branch choice does not replace other safety steps. Backups, updates and a firewall still matter. Our post on firewalls versus PHP updates explains why.

How we help at Amariq

Choosing between three PHP branches is easy on paper and harder once your plugins are in the picture. We pick the branch with the site in front of us, after a backup and a look at what the theme and plugins say about support. Within a day of the advisory, our team had already put WordPress sites on a fixed release. You can order that move by site size through the WordPress PHP update gig on Fiverr, and the wider picture sits on our WordPress development page. Read the Fiverr and Upwork reviews, and watch our YouTube channel, if you want proof of how we handle it.

Quick answers

What is the best PHP version for a WordPress site in 2026?

The advice from WordPress.org is PHP 8.3 or greater, with no single branch singled out. For most sites, 8.4 is a steady choice and 8.3 is fine if your plugins are proven on it. Whichever you pick, use the fixed release from the October 2026 advisory or newer.

Is PHP 8.3 still safe to use?

Yes, if it is 8.3.36 or newer. On php.net, 8.3 is listed with security support through 31 December 2027. Its active support period has ended, which means it gets security fixes only.

Should I jump straight to PHP 8.5?

Only if your WordPress, theme and plugins have been tested on it. The WordPress.org table lists WordPress 6.9, 7.0 and 7.1 as working with 8.5, though your plugins are a separate matter. Test on a copy first.

Is PHP 8.2 good enough?

The fix exists as 8.2.35, yet php.net puts the end of its security support at 31 December 2026. That is about two months away, so use it only as a short stop.

Will a newer PHP make my site faster?

It may, but we have no official figure to give you, so we do not promise one. Choose the branch for safety and support first. Speed is a bonus you can measure yourself after the change.

Can I switch PHP versions myself?

Often yes, in your host's control panel. If there is no switch, ask the host. Back up first and test afterwards, as set out in our PHP version update guide.

What if my site breaks after the change?

Ask your host to put the previous PHP version back, then restore your backup if needed. After that, find the plugin or theme that failed and update or replace it before you try again.

Does WordPress itself need an update because of the October 2026 flaws?

No. According to WordPress.org, nothing is required or planned on the WordPress side, since the repair lives in PHP on the server. Updating WordPress first can still be needed to make a newer PHP branch compatible.