WordPress PHP Security Updates

Your WordPress site runs on PHP, so the PHP release affects it directly. We move it to a patched PHP version, check every plugin and theme on a staging copy, then deploy with a backup and a rollback plan.

PHP patching · Plugin & theme compatibility · Backup and rollback

Start with the £149 PHP CheckAll PHP Update Services

Patched Quickly

We check your PHP version first, then patch or upgrade it the same or next working day for emergency jobs.

Plugins Tested First

We test every active plugin and theme on a staging copy before deploying, and roll back if anything breaks.

Easy Rollback

A full backup is taken before the change, so we can restore the previous state if something breaks.

What's Included

PHP version check and exposure review
Full backup before any change
PHP upgrade via your host or server config
Plugin and theme compatibility testing
WordPress core update if needed
Staging test and post-change checks
Restart of PHP workers / hosting cache clear
Written summary of what changed

Common Scenarios

Host Still on Old PHP

Your host runs an older PHP version that no longer gets upstream fixes. We plan and carry out the move safely.

Plugin Blocks the Upgrade

A plugin doesn't support the newer PHP release yet. We find the blocker, replace or patch it, and test again.

Emergency Lockdown

You need the site patched now and can't afford a long project. We patch, verify, and hand back a short report.

How a WordPress PHP Update Runs

1

£149 Check

We confirm the PHP version WordPress actually runs — via Site Health, not the hosting panel, which can show a different default — plus the patch level and CVE exposure. The active plugin and theme list is captured at the same time.

2

Staging Clone

A full copy of the site — core, theme, plugins and database — is built on staging running the target PHP version. This catches the classic failure: a plugin that works on 8.1 but fatals on 8.4.

3

Patch or Upgrade on Staging

PHP moves to the fixed or supported release. Front-end pages, wp-admin, media uploads, cron (WP-Cron or system cron) and the REST API are exercised; incompatible plugins are patched or replaced in scope.

4

Production Switch

The verified change is applied with a tested rollback, PHP-FPM restarted and object cache cleared. We re-check key pages and error logs before signing off — you get a written summary of what changed.

Pricing

Transparent, scope-based pricing. Every job includes a backup, a staging test and a post-change check.

Emergency Patch

£999

Same or next day

  • ✓Safe PHP patch to a supported release
  • ✓Backup before change
  • ✓Staging check
  • ✓Post-patch verification
Most Popular

Managed Maintenance

£299 / month

£2,999 billed annually — two months free

  • ✓Ongoing PHP and dependency patching
  • ✓Advisory monitoring
  • ✓Monthly report
  • ✓Backups and uptime checks
  • ✓The £149 PHP check included to start
  • ✓WooCommerce stores: £349 / month

Version Upgrade

£4,999

1–3 weeks

  • ✓Move off end-of-life PHP
  • ✓Compatibility testing
  • ✓Staging QA
  • ✓Rollback plan and post-upgrade support

Prices are indicative ranges based on project scope. Contact us for a tailored quote.

Frequently Asked Questions

Which PHP version should my WordPress site run?+

Use a PHP version that is still supported and has the security fix. Upstream PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. We'll confirm which one suits your plugins.

Will a PHP upgrade break my plugins?+

It can. That's why we test every active plugin and theme on a staging copy before deploying. Anything that doesn't support the new version gets a fix or a replacement, agreed with you first.

I'm on managed WordPress hosting. Do I still need this?+

Possibly. Some hosts patch PHP for you, others leave it to you. We'll check what your host has applied and fill any gap.

What about page builders like Elementor or Divi?+

They're tested like any other plugin — builders are PHP-heavy and a common break point on PHP upgrades. The staging clone includes your builder, and we spot-check rendered pages, not just the admin.

My host says PHP 8.1 is still supported by them. Am I safe?+

Partially. Vendor backports fix some issues but not necessarily CVE-2026-109618/109619 — upstream never released an 8.1 fix. The £149 check verifies exactly which fixes your vendor applied rather than taking the word 'supported' at face value.

Start With the £149 PHP Check

Tell us which application you run and which PHP version it's on. You get a written report of your exposure and the recommended next step.

Start with the £149 PHP CheckPHP Update Services