WordPress Minimum PHP Version: What It Requires and What Is Safe

Key takeaways

• The minimum is PHP 7.4. WordPress.org's requirements page says WordPress also runs on PHP 7.4 or newer, and it warns that this version has reached end of life.
• The recommended version is PHP 8.3 or newer. The same page, last modified 7 May 2026, puts 8.3 or newer as its recommendation, along with MariaDB 10.11 or MySQL 8.0 or newer.
• "WordPress works on it" is not the same as "PHP supports it." WordPress can run on a PHP branch long after the PHP project stops fixing it.
• Safe means a branch that still gets fixes, at a fixed patch level. On 21 October 2026, php.net announced fixes in a corrected release of its branch.
• Your WordPress version limits your PHP choice. The official compatibility table shows that some older WordPress releases do not support the newest PHP.
• Check in Site Health. Site Health, Info tab, Server block shows the PHP version.

Three words that mean different things

People say "minimum PHP version" and mean three separate ideas. Mixing them up is how sites end up on old PHP with a clear conscience.

Minimum is about whether WordPress starts. Recommended is about speed and security as WordPress sees them. Safe is about whether anyone is still repairing the PHP underneath. WordPress.org tells you the first two. The PHP project tells you the third.

What WordPress.org says today

Two official pages, both read on 22 October 2026, give the numbers.

Notice the wording. WordPress.org itself calls 7.4 end of life on the requirements page. So even the minimum is labelled as a risk.

The official table of WordPress against PHP

WordPress keeps a developer page called PHP Compatibility and WordPress Versions on make.wordpress.org. It was last updated 19 August 2026, per the page. It marks each pairing with Y for supported or N for not supported. It says WordPress software is tested and compatible with the versions listed, and that it dropped the old "beta support" label in May 2026.

Here is a short extract of the current table. We have kept the columns that matter most to site owners.

Source: make.wordpress.org, PHP Compatibility and WordPress Versions, page updated 19 August 2026. The page lists older WordPress versions too, with older PHP branches.

Three things to take from it.

1. Newer WordPress opens up newer PHP. Per the table, WordPress 6.8 and 6.7 are not marked supported on PHP 8.5, while 6.9 and the two newest rows are. If you want PHP 8.5, you need a recent WordPress.
2. Old WordPress can block new PHP. The page also lists much older WordPress versions, and in its tables, WordPress 6.3 and older are marked as not supported on PHP 8.3 and newer. A site stuck on an old WordPress version may be stuck on an old PHP too, and that is a problem worth fixing, not living with.
3. Every row in this extract shows Y for PHP 7.4. So on paper, WordPress runs there. That is the "works" side of the story, and it is where the next section starts.

"WordPress works on it" does not mean "PHP supports it"

The compatibility table answers one question: does WordPress run on this PHP? It does not answer the question that matters for security: does the PHP project still fix this PHP?

On 21 October 2026, php.net announced fixes for two critical remote code execution flaws in a corrected release of its branch. It also said PHP 8.1 and older no longer receive updates from the PHP project, though it gave minimal source backports for 7.4, 8.0 and 8.1, and some Linux vendors got patches in advance. For the full story, read our main guide to the PHP vulnerability of October 2026.

Now compare that with the table above. WordPress 6.4 through 7.1 are all marked Y on PHP 8.0 and 7.4. Yet those PHP branches are past the PHP project's own support. So a site can be fully "supported" by WordPress and still sit on a PHP branch with no regular fixes.

Kinsta's PHP page, updated 8 June 2026 and citing endoflife.date, gives the branch dates.

Kinsta says nearly half of WordPress sites still run an end-of-life PHP version. That is their claim, and we have not checked it ourselves. Our post on PHP end of life dates goes deeper on these dates.

So what is a safe PHP version for WordPress?

Put the three layers together.

• Floor: PHP 7.4 is the minimum WordPress runs on, but it is end of life. Do not choose it on purpose.
• WordPress's advice: PHP 8.3 or newer.
• Safe in practice: a branch that still gets security fixes, on a patch at or above the fixed release. That means 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer on the same branch.

PHP 8.2 passes today but its security support is listed as ending in December 2026, so it is a poor place to settle. If your plugins allow it, 8.3 or 8.4 is the sensible target, and 8.5 once your WordPress version and plugins support it. Kinsta calls 8.4 the safer default.

Do not forget the other half of the stack. WordPress.org recommends MariaDB 10.11 or newer, or MySQL 8.0 or newer, and requires HTTPS support. Ask your host about those at the same time as PHP.

How to check and move

Read your PHP version from the Server block on the Info tab of Site Health. Our guide to checking your PHP version in WordPress, cPanel and the command line shows other routes, and the guide to checking and updating PHP on WordPress walks through the backup, plugin check and switch. If your host controls the version, send the questions from our guide on what to ask your web host.

If a plugin or theme will not run on a newer PHP, treat that as the real finding. The cost of replacing it is usually smaller than the cost of staying on a branch that nobody repairs. See our post on WordPress website cost for how upkeep fits into the yearly picture.

How we help

We build and look after WordPress sites, and PHP, plugin and theme updates sit inside our maintenance work, always with a backup and a test first. You can read about WordPress development and Webflow maintenance. Some owners decide they would rather not manage servers at all, and Webflow migration moves a WordPress site across while keeping its addresses. We price from scope, never by the hour. This post is general information, not a guarantee of safety or legal advice.

Frequently asked questions

What PHP version does WordPress need?

WordPress.org says it runs on PHP 7.4 or newer and recommends PHP 8.3 or higher. It also notes that 7.4 has reached end of life. So 7.4 is the floor, not a good choice.

What is the minimum PHP version for WordPress?

PHP 7.4, according to the WordPress.org requirements page, last modified 7 May 2026. Treat it as the point where WordPress stops working, not as a safe setting.

Is PHP 8.2 still fine for WordPress?

It works with the current WordPress versions in the official table, and php.net fixed it in 8.2.35. But Kinsta lists its security support as ending in December 2026, so plan to move to 8.3 or 8.4.

Can I run the newest PHP on an old WordPress version?

Not always. The official table marks older WordPress versions as not supported on newer PHP, and WordPress 6.8 and 6.7 are not marked supported on PHP 8.5. Update WordPress first, then raise PHP.

If WordPress supports my PHP version, am I protected?

No. WordPress support means the software runs. It does not mean the PHP project still fixes that branch. Check the branch dates and your patch number as well.

Where do I see my PHP version in WordPress?

Open the Info tab in Site Health and look at Server. If you cannot log in, your hosting panel or your host can tell you.

Do I need to update WordPress for the October 2026 PHP flaws?

WordPress.org said no WordPress update is required for them, because they are PHP flaws and not WordPress flaws. The fix is a newer PHP at your host. Updating WordPress is still useful if you want a newer PHP branch to be supported.