Why websites get stuck on old versions of PHP, and how to move them on

How many websites are on old PHP

PHP runs around 69% of the websites whose server-side software can be identified, according to W3Techs, which tracks the technology behind the most visited sites on the web. Of those PHP sites, 34.7% still run PHP 7 or older, including 7.7% on PHP 5, and another 13.7% are on PHP 8.0 or 8.1. None of those versions get security fixes any more.

PHP 8.2 joins them at the end of December 2026. When it does, around two thirds of PHP websites will be on a version that's out of support.

• 48%of PHP websites run a version that no longer gets security fixes
• 7.7%still run PHP 5, which stopped getting fixes in 2018
• 2 in 3will be out of support once PHP 8.2's fixes end in December 2026

Why sites get stuck

Plenty of these sites are still running because moving them on is harder than it looks. Code written for PHP 5 or 7 often relies on functions that newer versions have removed, or on looser rules about how data is handled, so it breaks on an upgrade until it's rewritten.

Some sites were built on platforms that have since been retired themselves, such as Drupal 7, Magento 1 or older versions of Joomla. Some were supplied with their code encrypted, using tools like ionCube or Zend Guard, so it can't be read or changed, and the encrypted files only run on the PHP versions they were made for. And some were built by a developer or company that's no longer around, so nobody knows the code well enough to change it with confidence.

Because the site keeps working, it's easy to leave alone until something forces the issue.

How one old application holds back the whole server

An old site rarely ages on its own. Newer operating systems don't offer old versions of PHP, so to keep an old application running, the server underneath it gets held back too. Control panels such as cPanel and Plesk only run on operating systems they still support, so they end up stuck at the same point, along with the database, the web server and the encryption the server uses to talk to browsers.

That changes the risk. Alongside an application with known holes in it, you have a whole server that stopped getting security updates years ago, and on a shared server, that risk is shared by every site on the machine. Unsupported software also tends to fail quietly, carrying on as normal right up until someone gets in.

If that server holds customer or staff details, it's a data protection problem as well. UK data protection law expects personal data to be kept secure, and a breach that puts people's details at risk has to be reported to the ICO within 72 hours.

Why PHP2Shell makes it urgent

In October 2026, PHP2Shell showed what this means in practice. A critical flaw affecting every version of PHP was fixed the same day for PHP 8.2 and newer, and supported servers were updated within hours. Servers on PHP 5 or 7 will never get an official fix.

What the options are

Where the code can be read and isn't too far gone, it can be updated to run on a supported version of PHP, then tested and switched over. That's usually the quickest route for sites on PHP 7 or early PHP 8.

Where it can't, because it's encrypted, very old or simply not worth saving, the better route is often to rebuild only the parts the business still uses. A system that other services connect to can keep the same addresses, so nobody relying on it needs to change anything, and the old server can then be switched off.

If neither can happen straight away, there are ways to buy time. Some providers sell extended security support for older PHP versions, such as TuxCare, which keeps PHP itself patched past its end of life. Putting the site behind a firewall service such as Cloudflare, limiting who can reach it and taking unused parts offline all reduce the risk too. None of these fix the application itself, though, so they're best treated as a bridge to one of the two routes above.

How we can help

If your website or system runs on an old version of PHP, get in touch and we'll check it for you, free of charge, and tell you which route makes sense, whether that's an upgrade or a rebuild of the parts you still use.