Unpatched Threats and Performance Leaps: Why WordPress Sites Must Embrace Modern PHP

A recent presentation at WordCamp Europe by veteran WordPress developer Milan Petrović underscored the urgent need for WordPress websites to abandon outdated PHP versions and embrace the security and performance enhancements offered by PHP 8.x. Petrović, a full-stack developer at Freemius, warned that continuing to operate on legacy PHP platforms, particularly versions like 7.4 and older, exposes sites to thousands of known vulnerabilities and significantly hampers efficiency, presenting an "active invitation for automated exploitation." The insights shared during his talk and a subsequent interview on the WP Tavern’s Jukebox Podcast highlighted a critical juncture for the world’s most popular content management system.

The Critical Call to Action: Upgrading PHP

WordPress, which powers over 43% of all websites, relies heavily on PHP, a server-side scripting language. While many users may only vaguely be aware of PHP versions visible in their hosting panels, their impact on a website’s security, speed, and overall health is profound. Petrović’s core message is that modernizing PHP isn’t merely a best practice; it’s a crucial step for the longevity and integrity of any WordPress site. The conversation at WordCamp Europe, a premier gathering for the global WordPress community, provided a significant platform to address this often-overlooked aspect of web development.

WordCamp Europe, held in Torino, Italy, in 2024, served as a hub for developers, designers, agencies, and users to exchange knowledge and discuss the future of WordPress. Petrović’s session, "Secure by Design: Hardening Plugins with PHP 8.x," resonated with attendees, sparking numerous questions and discussions on a topic that blends technical detail with broad implications for the entire ecosystem.

Milan Petrović’s Expertise and WordCamp Europe Presentation

Milan Petrović brings nearly two decades of hands-on experience to this critical discussion. His journey within the WordPress ecosystem began in 2007, where he immersed himself in developing a diverse array of plugins, notably for expanding bbPress forums. After years of running his own company, Dev4Press, which focused on creating plugins, he joined the Freemius team as a full-stack developer in 2024. This extensive background has given him a unique vantage point to witness the evolution of both WordPress and the PHP landscape, making him an authoritative voice on the subject of PHP modernization.

His WordCamp Europe presentation delved into how reliance on legacy PHP code directly exposes websites to a staggering number of unpatched bugs and vulnerabilities. He emphasized that in 2024, operating with PHP 7 code, which reached its end-of-life for active support in December 2019 and security support in December 2022, is not just a "bad habit" but an "active invitation for automated exploitation." The talk advocated for a shift from a reactive "whack-a-mole" approach to sanitization to a proactive strategy of building products "secure by design" using modern PHP capabilities.

The Perils of Legacy PHP: An Open Invitation to Exploitation

The most alarming aspect highlighted by Petrović is the sheer volume of known, unpatched vulnerabilities in older PHP versions. His research indicates that PHP 7 and PHP 5, still in use by millions of WordPress websites, collectively harbor between 3,000 and 4,000 open and confirmed bugs that will never receive official fixes. These bugs are publicly documented, making them readily available targets for malicious actors. "There are open exploits that run on the PHP level," Petrović explained, "They don’t care really about if you are using WordPress or using something else. It’s more like an exploit on the level of a, on a server side that can be quite scary."

This situation means that websites running on these legacy PHP versions are inherently vulnerable to exploits that target the underlying server-side language, regardless of the security measures implemented at the WordPress application layer. Such vulnerabilities can lead to severe consequences, including data breaches, website defacement, denial-of-service attacks, and complete compromise of the server. The lack of ongoing support for these older versions means that any newly discovered vulnerability will also remain unaddressed, perpetually increasing the risk profile of affected sites.

Beyond Security: Performance and Efficiency Gains with PHP 8.x

While security is a primary concern, the benefits of upgrading to modern PHP extend significantly to performance and operational efficiency. Petrović highlighted that each new PHP version brings substantial performance improvements, typically ranging from 5% to 10% faster execution without any code changes. This cumulative effect is dramatic: "PHP 8.5 is more than 50% faster than PHP 7.4," he stated. This speed increase directly translates into quicker page load times, a better user experience, and improved SEO rankings.

Moreover, modern PHP versions, particularly PHP 8.x, demonstrate significantly reduced memory usage. Petrović presented a compelling slide showing how the same piece of code could run with almost half the memory on PHP 8.5 compared to PHP 7.4. This efficiency is a game-changer for hosting companies, enabling them to serve more websites with the same infrastructure, thereby freeing up valuable resources and potentially reducing operational costs. For individual website owners, it means a more responsive site and less strain on hosting resources.

WordPress’s Backward Compatibility Dilemma

The persistent challenge in accelerating PHP adoption within the WordPress ecosystem stems from its foundational commitment to backward compatibility. This policy, while instrumental in WordPress’s widespread adoption by making it accessible to a broad, non-technical audience and enabling affordable hosting, has also become a bottleneck. "WordPress got a lot of adoption from backwards compatibility policies," Petrović acknowledged, "But in the same time, that also proved a bit of a problem. Because even the WordPress Core code is kind of stuck because of that policy."

As of mid-2024, official WordPress statistics reveal that a significant portion of websites still run on outdated PHP versions. Approximately 20% remain on PHP 7.4, with a smaller, yet concerning, percentage still on PHP 5. This inertia means that WordPress Core itself continues to support PHP versions that have been end-of-life for years, hindering its own ability to fully leverage modern PHP features like stricter typing, which enhance code robustness and security.

This situation presents a complex dilemma. Forcing a rapid upgrade to PHP 8.x as a minimum requirement would undoubtedly break many older plugins and themes that have not been updated, leading to widespread disruption for millions of users who treat their websites as static entities. "You can imagine those kind of stories a million times over coming to the fore," Nathan Wrigley remarked during the interview, drawing an analogy to a bicycle that users expect to work indefinitely without maintenance. However, as Petrović aptly countered, "You need to maintain your bike. If you don’t do it, it’s going to, your belt is going to rust, your wheels are going to be deflated or whatever." The analogy perfectly encapsulates the need for proactive maintenance in the digital realm.

The Role of Hosting Providers and Developers

Petrović emphasized that the responsibility for accelerating PHP adoption falls on all stakeholders:

• Hosting Companies: They are arguably the biggest factor. While upgrading their server infrastructure requires significant investment and carries the risk of customer support issues if sites break, the long-term gains in performance and resource optimization are substantial. More expensive, managed hosting solutions often lead the way by enforcing newer PHP versions, but the broader market lags.
• Plugin and Theme Developers: Many developers, especially those maintaining popular plugins, have already invested in updating their code to support PHP 8.x. However, a vast number of older or less maintained plugins continue to rely on legacy PHP, creating a dependency chain that prevents users from upgrading. Petrović himself has adopted a policy of requiring PHP 8.0 as a minimum for his plugins, updating his code gradually.
• End-Users: While not expected to delve into technical complexities, users need greater awareness of the risks and benefits. The current WordPress dashboard notices about PHP updates are often "too much and too little information at the same time" for many.

The Vulnerability Lab Plugin: A Practical Demonstration

To practically illustrate the stark differences between legacy and modern PHP, Petrović developed the "Vulnerability Lab" plugin, specifically for his WordCamp Europe talk. This plugin serves as a demonstration tool for developers, showcasing how common exploits, such as authentication bypass and server-side request forgery, succeed on legacy code but are neutralized by the native shields and stricter paradigms of modern PHP.

The plugin allows developers to run examples of code on different PHP versions, revealing contrasting outcomes. For instance, a piece of code might result in a fatal error on PHP 7.4 but execute flawlessly on PHP 8.x. It also visually demonstrates performance differences, such as memory usage, making the abstract benefits tangible. Petrović plans to expand the plugin to include more examples and possibly a "pattern library" to guide developers in modernizing their code. This tool is particularly valuable for agencies to educate clients on the necessity of upgrades and the inherent risks of maintaining outdated systems.

A Gradual Path to Modernization

Petrović stressed that the transition to modern PHP doesn’t have to be an abrupt, all-at-once overhaul. It can, and should, be a gradual process. Developers can begin by implementing small changes like stricter typing or adopting new attributes offered by PHP 8.x, slowly modernizing their codebase over time. This incremental approach makes the task less daunting for both core WordPress development and individual plugin/theme authors.

He also clarified that upgrading PHP is not a replacement for existing WordPress security best practices. "We still need to use all the security enhancements that WordPress has built in the Core. Escaping, sanitization. All that is still very important," he affirmed. The goal is a combination: leveraging WordPress’s robust application-level security alongside the inherent language-level security and performance benefits of modern PHP.

The Broader Ecosystem and Future Outlook

The broader PHP ecosystem is also driving the push for modernization. Many popular third-party libraries, which WordPress plugins and themes frequently rely upon, have already moved beyond PHP 7.4, now requiring PHP 8.1 or 8.2 as minimums. This creates a natural pressure for developers to upgrade their plugin requirements to align with their dependencies, even if they might otherwise be hesitant. The PHP project itself maintains a predictable release cycle, with a new feature version (e.g., PHP 8.6) released every December, ensuring a continuous stream of improvements. Developers are encouraged to monitor the official PHP website for detailed change lists and upcoming features.

While WordPress Core’s pace of PHP adoption is slower due to its vast user base and backward compatibility commitments, the increasing awareness and the benefits offered by modern PHP are undeniable. The conversation at WordCamp Europe and the efforts of advocates like Milan Petrović aim to accelerate this transition. The coming years will likely see a continued push for higher minimum PHP versions within WordPress, gradually compelling the ecosystem to shed its legacy constraints and embrace a more secure, performant, and future-proof foundation. The ultimate goal is to move the millions of WordPress sites from a state of "active invitation for automated exploitation" to one of "secure by design."