Securing WordPress: The Urgent Call to Embrace Modern PHP 8.x for Enhanced Safety and Performance

The WordPress ecosystem, powering over 43% of all websites globally, faces a critical juncture concerning its underlying technology: PHP. While its renowned backward compatibility has historically fueled widespread adoption, a growing chorus of experts, including full-stack developer Milan Petrović, warns that relying on outdated PHP versions is no longer a benign oversight but an active invitation to digital disaster. Petrović, a veteran with nearly two decades immersed in the WordPress and PHP landscapes, recently delivered a compelling presentation at WordCamp Europe, urging a swift transition to PHP 8.x to fortify websites against pervasive threats and unlock significant performance advantages. His insights, shared on the Jukebox Podcast from WP Tavern, underscore a pressing need for collective action across the WordPress community – from core developers and hosting providers to agencies and end-users.

Expert Insight from WordCamp Europe: Milan Petrović on PHP Modernization

Milan Petrović’s journey in the WordPress realm began in 2007, where he carved a niche developing an array of plugins, particularly for expanding bbPress forums. His entrepreneurial spirit led him to found Dev4Press, his own plugin company, before he transitioned to Freemius as a full-stack developer in 2024. This extensive hands-on experience has afforded him a unique perspective on the evolution of both WordPress and PHP, making him a poignant voice on the current state of affairs.

At WordCamp Europe, one of the premier gatherings for the global WordPress community, Petrović’s presentation titled "Secure by Design: Hardening Plugins with PHP 8.x" resonated deeply with attendees. He articulated that in an era dominated by sophisticated automated exploitation, adhering to legacy PHP 7 code is not merely a "bad habit" but a fundamental security vulnerability. His talk wasn’t just theoretical; it showcased practical comparisons using a custom "Vulnerability Lab" plugin, demonstrating how common exploits like authentication bypass and server-side request forgery successfully compromise sites running on legacy PHP, only to be neutralized by the inherent protections of modern PHP 8.x.

The PHP Upgrade Imperative: Security First

The most alarming aspect highlighted by Petrović is the sheer volume of unpatched vulnerabilities lurking within older PHP versions. He cited statistics revealing 3,000 to 4,000 confirmed, open bug reports for PHP 7 and PHP 5 that will never be addressed. Given that PHP 7.4 reached its official End-of-Life (EOL) for security support on November 28, 2022, and PHP 5.6 on December 31, 2018, these thousands of known flaws represent a gaping chasm in website defenses. These are not obscure vulnerabilities; they are publicly documented, readily accessible to malicious actors, and ripe for automated exploitation.

For millions of WordPress users, who might only vaguely recognize PHP version numbers in their hosting control panels, this reality presents an existential threat. A significant portion of the WordPress user base remains on these vulnerable versions. According to recent WordPress statistics referenced by Petrović, approximately 20% of WordPress sites still operate on PHP 7.4, with a "few percent" even lingering on PHP 5. This substantial segment of the internet is effectively running on a perpetually exposed foundation, making them prime targets for cyberattacks that can lead to data breaches, website defacement, and service disruption. The transition to PHP 8.x, therefore, is not merely a recommendation; it is a critical security mandate that provides "native shields" against a wide range of exploits, significantly hardening the underlying infrastructure.

Beyond Security: Unlocking Performance Gains

While security forms the cornerstone of the argument for upgrading, Petrović also emphasized the substantial performance benefits offered by modern PHP versions. Each new iteration of PHP, particularly since the release of PHP 8.0 in late 2020, has brought with it significant optimizations in speed and efficiency. Petrović noted that PHP 8.5 is "more than 50% faster than PHP 7.4," with each new version generally delivering a 5% to 10% performance boost without any code changes required from the developer.

Crucially, this performance enhancement extends to memory usage. Petrović presented compelling data showing how PHP 8.5 uses "almost half the memory" to execute the exact same piece of code compared to older versions. For hosting providers, this translates directly into significant resource savings, allowing them to host more websites on the same infrastructure, thereby reducing operational costs and potentially improving service quality for their clients. For website owners, faster loading times contribute to a better user experience, improved search engine rankings, and ultimately, higher conversion rates. The economic and operational advantages of modernization are clear and immediate.

WordPress’s Backward Compatibility Dilemma

The challenge of accelerating PHP adoption within the WordPress ecosystem is deeply intertwined with its foundational philosophy of backward compatibility. This policy, designed to make WordPress accessible and functional across diverse hosting environments and with myriad plugins and themes, was instrumental in its rise to global dominance. By minimizing the need for frequent server upgrades or extensive software modifications, WordPress became a highly attractive, low-barrier-to-entry platform.

However, this strength has evolved into a significant bottleneck for modernization. Petrović pointed out that "even the WordPress Core code is kind of stuck because of that policy." While WordPress itself is largely compatible with PHP 8.x, the official minimum required PHP version for WordPress Core has lagged significantly behind PHP’s own EOL cycle. This cautious approach means WordPress continues to support PHP versions that have long ceased receiving official security updates from the PHP development team. This reluctance to "ditch the 7 branch" or older versions creates a permissive environment for hosting companies and plugin developers to continue supporting outdated, insecure technology.

The dilemma for the WordPress Core team is profound: force a rapid upgrade and potentially alienate millions of users whose sites might break due to incompatible plugins or themes, or maintain a slower pace, thereby prolonging the exposure to known vulnerabilities. While the current approach prioritizes stability and broad accessibility, the long-term health and security of the platform necessitate a more aggressive stance on minimum PHP requirements.

The Role of Hosting Providers

Hosting companies are pivotal players in the PHP upgrade narrative. For them, the decision to maintain older PHP versions is a complex calculation involving customer support burden, infrastructure investment, and market demand. Upgrading server environments to newer PHP versions requires significant investment in reconfiguring systems, testing for compatibility issues, and potentially retraining staff to handle new types of support requests. When a website breaks after a server-side PHP update, the hosting provider is often the first point of contact, leading to increased support costs and potential customer dissatisfaction.

Despite these challenges, the economic incentives for hosts to upgrade are substantial: reduced memory usage, faster processing, and improved security translating into more efficient use of resources and a more resilient platform. Some managed WordPress hosting providers have already taken the lead, proactively forcing their users onto modern PHP versions (e.g., 8.2 or 8.3), demonstrating that it is achievable. These providers often invest heavily in compatibility testing and offer robust support to mitigate transition issues. Petrović’s call is for a broader movement, encouraging all hosting providers to recognize the long-term benefits that outweigh the initial investment and support overhead.

Empowering Developers: Milan’s Vulnerability Lab Plugin

To bridge the knowledge gap and provide practical tools for developers, Petrović created the "Vulnerability Lab" plugin. This innovative tool, available on GitHub, is designed to illustrate how code exploits manifest differently across various PHP versions. It allows developers to run specific code examples and observe their behavior on both legacy and modern PHP environments. For instance, a piece of code that results in a fatal error or a security bypass on PHP 7.4 might execute flawlessly and securely on PHP 8.x.

This plugin serves multiple purposes:

• Demonstration: It offers a tangible way for developers and agencies to visually demonstrate the security and performance implications of outdated PHP to clients. Instead of abstract warnings, clients can see "why it is bad actually."
• Learning: It acts as a pattern library, guiding developers on how to leverage new PHP 8 features (like stricter typing and attributes) to write more resilient code.
• Gradual Modernization: It supports the idea that modernization doesn’t have to be an all-at-once overhaul. Developers can start by implementing small changes and gradually adopt more complex security measures.

The Vulnerability Lab plugin underscores the idea that while WordPress’s built-in security mechanisms (escaping, sanitization) remain crucial, they should be complemented by the "native shields" and performance enhancements of modern PHP. The combination of these layers creates a far more robust defense.

A Call for Gradual Modernization and Future Outlook

Petrović’s message is clear: the WordPress community must accelerate its adoption of modern PHP. He advocates for WordPress to declare PHP 8.0 or 8.1 as the next minimal required version, arguing that this would send a strong signal to hosting providers and plugin developers, encouraging them to update their offerings. While WordPress Core is compatible with newer PHP versions, such a declaration would empower its developers to modernize the core code more aggressively, leveraging stricter typing and other new features that enhance code quality and security.

The broader PHP ecosystem is already moving forward at a rapid pace. With a predictable release cycle that introduces a new feature version every December (e.g., PHP 8.6 expected this year), developers outside of WordPress are increasingly building libraries that require PHP 8.1 or 8.2. This external pressure will inevitably force some WordPress plugin and theme developers to upgrade their own PHP requirements to utilize the latest, most secure versions of these third-party dependencies.

Ultimately, the future health and competitiveness of WordPress depend on its ability to evolve with modern web technologies. Embracing PHP 8.x is not just about keeping up; it’s about proactively securing millions of websites, enhancing their performance, and positioning WordPress for continued success in an ever-changing digital landscape. The journey may be gradual, "one update, one plugin at a time," but the imperative for change is undeniable.