To update the PHP version in WordPress, check which version you run under Tools, Site Health, Info, then change it in your hosting control panel: PHP Configuration in Hostinger's hPanel, MultiPHP Manager in cPanel or the PHP settings in Plesk. WordPress cannot change PHP itself; your hosting does. Take a backup first, and test the pages that bring you business afterwards.
The reason to do it this week: on 21 October 2026 the PHP project released security updates for two critical flaws, named PHP2Shell by the researchers who found them, in the engine underneath WordPress. I have explained what that means for business owners in PHP2Shell: what WordPress site owners should do now. This guide is the practical part. If you would rather not touch the server at all, a WordPress developer in Dubai can do it with you.
Step 1: check your PHP version in Site Health
The quickest way to check the PHP version in WordPress is the Site Health screen. Log in as an administrator and go to Tools, then Site Health. If WordPress considers your PHP too old, the Status tab shows it as a critical issue: "Your site is running an outdated version of PHP, which requires an update." For the exact number, open the Info tab and expand the Server section, where the PHP version is listed.
Write down the full number, for example 8.3.36 rather than just 8.3. The last part tells you whether the latest security release is installed. Site Health only reports the version; WordPress's own documentation says you cannot configure settings from that screen.
Step 2: back up, and test on a copy first
- Take a full backup, files and database, and keep a copy off the server. Most hosts have a backup tool in the control panel, and a backup plugin works too.
- Use a staging copy if your host offers one. Change PHP there first, click through the site, then repeat on the live site.
- Update WordPress, your theme and your plugins before you change PHP, so each one is on its most compatible release.
- Note any plugin or theme that has not been updated in years, or whose developer has stopped supporting it. Those are the ones most likely to break, and the ones to replace.
Step 3: update the PHP version in WordPress on Hostinger
In Hostinger's hPanel, go to Websites and click Dashboard next to your site, then find PHP Configuration in the sidebar. Choose the version and click Update. Hostinger says the change takes a couple of minutes and applies to every website on the same hosting plan, so check each site on the plan afterwards, not just one.
Hostinger's help article also says it offers PHP 8.2 and above, and that you cannot switch back to a lower version except within the same login session if something goes wrong. That makes the backup in step 2 more important, not less. To confirm your Hostinger PHP version afterwards, open Site Health again or look at the PHP Configuration page.
Step 4: change PHP in cPanel, Plesk or managed hosting
cPanel: MultiPHP Manager
In cPanel, open MultiPHP Manager, which most hosts place under Software. Tick the checkbox next to your domain, choose a version from the PHP Version menu and click Apply. cPanel's documentation notes that if the version you want is not listed, it is either not installed on the server or not available to your account, which is a question for your host. Some hosts replace this screen with their own PHP selector; the idea is the same.
Plesk: PHP settings
In Plesk, go to Websites & Domains, find your domain and click PHP. Make sure PHP support is ticked, choose the version from the drop-down and click OK. Plesk's documentation warns that different PHP versions are not 100% compatible, and suggests switching to a different version if the site stops displaying correctly.
Managed WordPress hosting: ask support
On managed WordPress hosting, or a server a previous developer set up, you may not see a PHP setting at all. Open a support ticket and ask three things: which PHP version the site runs, whether it includes the 21 October 2026 security fixes, and when they will move you to a supported version. Ask for the answer in writing.
Step 5: test what earns you money
Once the version has changed, check the site as a customer would, not just the homepage.
- Submit every enquiry form and confirm the lead arrives in your inbox or CRM.
- If you sell online, run a test order through checkout and payment.
- Clear the cache in your caching plugin, at your host and in any CDN such as Cloudflare, then reload the key pages.
- Open Site Health again and confirm the new version under Info, Server.
- Check your analytics the next day to make sure visits and conversions are still being recorded.
What to do if the site breaks after a PHP update
A blank page, a critical error message or a broken layout straight after a PHP change usually means a plugin or theme does not support the new version. Switch PHP back to the previous version in your control panel if your host allows it, or restore the backup you took in step 2. Then find the plugin responsible, update or replace it, and try again on staging.
Rolling back buys time; it is not a destination. php.net says PHP 8.1 and older no longer receive updates from the PHP project, so a site rolled back to one of those stays exposed until the plugin problem is solved.
Where these steps come from
WordPress: the Site Health screen(opens in a new tab)
Where Site Health lives, what the Status and Info tabs show, and the outdated PHP warning.
Hostinger: changing the PHP version in hPanel(opens in a new tab)
The hPanel steps, the versions offered and the note on switching back.
cPanel: MultiPHP Manager(opens in a new tab)
How to set a PHP version per domain, and why a version may be missing from the list.
Plesk: PHP settings(opens in a new tab)
The Websites & Domains steps and the compatibility warning.
php.net: security advisory of 21 October 2026(opens in a new tab)
The fixed versions and the support status of PHP 8.1 and older.
Make PHP part of your monthly upkeep
Most WordPress routines cover core, plugins and themes and forget the layer underneath. Add a PHP check to the same monthly list, alongside the other items in my WordPress security checklist, and the next security release becomes a two-minute job rather than a scramble.
If you would like a second pair of eyes before you change anything, book a free call. We can check your version, your host's settings and what might break, together.