PHP version without updates

Why it matters

PHP runs the code of WordPress and most other systems. Once a version is out of support, every new hole stays open. Hosts often keep old versions available, so a site can run on one for years without anybody noticing.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It reads the PHP version from the response headers of the homepage, when the server shows it, and compares it with the oldest version that still gets security updates (8.2).

Common causes

• The PHP version was never changed after the site was built
• An old plugin or theme does not work on a newer version
• The host does not upgrade automatically

How to fix it

1. Make a backup of the site.
2. Test the site on a copy with PHP 8.2 or newer.
3. Update or replace plugins and themes that break.
4. Switch the live site to the new version at the host.
5. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Your site runs on PHP without security updates". When everything is in order, the report says: "PHP still receives security updates".