The digital landscape of WordPress, powering over 43% of the world’s websites, stands at a pivotal juncture regarding its underlying technology: PHP. A recent discussion at WordCamp Europe 2024, featured on the Jukebox Podcast from WP Tavern, highlighted the urgent need for WordPress users, developers, and hosting providers to embrace modern PHP versions, specifically PHP 8.x, to safeguard against escalating security threats and unlock significant performance enhancements. Milan Petrović, a seasoned WordPress developer and full-stack engineer at Freemius, delivered a compelling presentation and subsequent interview, shedding light on the "existential risks" posed by continued reliance on legacy PHP code.
The PHP Landscape: A Foundation for Vulnerability or Fortification
PHP, a server-side scripting language, is the backbone of WordPress. Its evolution has seen significant strides, particularly with the release of PHP 8.x. However, a substantial portion of WordPress websites continues to operate on older, unsupported versions, most notably PHP 7.4, which reached its end-of-life (EOL) in November 2022. This means that PHP 7.4, along with even older versions like PHP 5.x, no longer receives official security patches or bug fixes from the PHP development team.
Petrović underscored the gravity of this situation, revealing alarming statistics: there are an estimated 3,000 to 4,000 open and confirmed bugs for PHP 7 and PHP 5 that will never be addressed. While not all are security-related, a significant portion represents critical vulnerabilities. "Relying on old versions is, as he describes, an active invitation for automated exploitation," the podcast noted. These unpatched flaws are publicly documented, providing a ready-made blueprint for malicious actors to exploit. Automated bots tirelessly scan the internet for websites running these vulnerable PHP versions, making them easy targets for attacks that bypass traditional WordPress security measures.
The impact extends beyond security. Each new PHP version brings notable performance improvements. Petrović highlighted that PHP 8.x offers a substantial speed increase, with PHP 8.5 being over 50% faster than PHP 7.4, alongside significant reductions in memory usage. These efficiencies translate directly into faster loading times for users and lower operational costs for hosting providers.
WordPress’s Backward Compatibility Conundrum
WordPress’s immense success is often attributed to its foundational principle of backward compatibility. From its inception, the platform prioritized accessibility, enabling millions to publish online without needing frequent server upgrades or complex technical adjustments. This policy facilitated widespread adoption, allowing hosting companies to offer affordable WordPress hosting without the pressure of maintaining the absolute latest server environments.
However, this strength has become a strategic impediment. Petrović argued that WordPress Core itself is "kind of stuck" due to this policy. While modern WordPress versions are compatible with PHP 8.x and even PHP 8.5, the official minimum required PHP version for WordPress remains stuck at a much older standard (currently PHP 7.0, with a recommendation for 7.4 or greater). This lag means that the WordPress ecosystem is currently "maybe six years behind end-of-life PHP versions," according to Petrović, as PHP 7.4 reached EOL four and a half years prior to the discussion (November 2022).
This conservative approach, while understandable from a user base perspective, creates a paradox. While WordPress aims to democratize publishing, it inadvertently exposes a vast number of its users to known, unpatched vulnerabilities by indirectly sanctioning the use of outdated server software. Statistics regularly released by WordPress indicate that approximately 20% of active WordPress sites still run on PHP 7.4, with a small but concerning percentage still on PHP 5.x. This persistent usage of EOL versions significantly widens the potential attack surface for the entire WordPress community.
The Dawn of PHP 8.x: Security and Performance Unleashed
PHP 8.x represents a significant leap forward in the language’s capabilities, offering "native shields" that fundamentally harden code against common exploits. Key improvements include:
- Stricter Typing: PHP 8.x introduced more robust type declarations (return types, property types, union types, intersection types), allowing developers to write more predictable and secure code. This helps prevent type juggling vulnerabilities and ensures data integrity.
- Named Arguments: Enhances code readability and reduces the chances of errors when calling functions with many parameters.
- Attributes (Annotations): Provides a way to add metadata to classes, methods, and properties, which can be leveraged by frameworks and libraries for various purposes, including security validation.
- Just-In-Time (JIT) Compilation: A major performance booster introduced in PHP 8.0, JIT compiles parts of the code into machine code, leading to significant speed improvements, especially for CPU-intensive tasks.
- Error Handling: Improved error reporting and the introduction of new error types make it easier for developers to catch and fix issues, preventing potential security loopholes.
- New Functions and Classes: Several new functions and classes offer more secure and efficient ways to handle common programming tasks, replacing older, less secure alternatives.
These features not only "close security holes" but also deliver substantial performance boosts, reducing memory usage and accelerating execution speed across the board. The collective effect is a more resilient, efficient, and secure web environment.
Stakeholder Perspectives: A Complex Web of Adoption
The push for PHP 8.x adoption involves a delicate balance among various stakeholders:
Hosting Providers: The Economic and Operational Calculus
Hosting companies are arguably the most critical players in driving PHP adoption. While migrating their infrastructure and customer base to newer PHP versions requires significant investment in development and support, the long-term gains are compelling. Petrović highlighted that the performance and memory efficiency of PHP 8.x mean hosts can run "more websites" on the same hardware, freeing up resources and potentially reducing infrastructure costs.
However, a major deterrent is the potential for increased support tickets. When a hosting provider forces a PHP upgrade, legacy plugins or themes that haven’t been updated can break, leading to customer complaints. Managed hosting providers often take a more proactive approach, forcing users onto newer, though not always the absolute latest, PHP versions (e.g., 8.2 or 8.3). In contrast, budget hosts, catering to a wider, often less technically savvy audience, tend to support older PHP versions for longer to minimize disruptions. Some larger hosts even maintain custom PHP builds, patching known bugs themselves, but this introduces its own set of risks and potential inconsistencies.
Developers: The Challenge of Migration and the Push from Libraries
For plugin and theme developers, the decision to support modern PHP is often a tightrope walk. They must weigh the benefits of leveraging new PHP features against the need to support the "lowest common denominator" to reach the broadest possible user base. Petrović, for instance, implemented a policy of 8.0 as a minimal version for his own plugins this year, acknowledging that the transition is gradual.
A significant external driver for developers is the increasing reliance on third-party libraries. Many modern PHP libraries (for tasks like parsing URLs, security, or data manipulation) have already moved beyond PHP 7.4, requiring PHP 8.1 or 8.2 as a minimum. This effectively "forces the hand" of developers who wish to use the latest, most secure versions of these libraries in their WordPress products.
End-Users: Bridging the Knowledge Gap
Many WordPress users, particularly those running small businesses or personal blogs, view their websites as "static commodities," much like a bicycle that simply needs to "work tomorrow in the same way that it did four years ago." They are often unaware of the underlying technologies and the continuous maintenance required for a secure online presence. The dashboard notices about PHP updates are often "too much and too little information at the same time," leaving users confused about how to proceed.
Petrović eloquently countered this analogy, reminding listeners that even a bicycle needs maintenance—lubricated chains, inflated tires—to function properly. Similarly, a website, a dynamic piece of software, requires ongoing updates to remain secure and performant. The challenge lies in educating this vast user base about the tangible risks of inaction and the clear benefits of modernization.
Demonstrating Risk: The Vulnerability Lab Plugin
To bridge the technical gap and visually demonstrate the immediate impact of PHP versions on security, Milan Petrović developed the "Vulnerability Lab" plugin. This tool allows developers to run specific code snippets and observe how common exploits, such as authentication bypass or server-side request forgery, succeed on legacy PHP versions but are "neutralized by the native shields of the latest PHP."
The plugin serves multiple purposes:
- Educational Tool: It graphically illustrates the differences in code execution and vulnerability across various PHP environments.
- Demonstration Aid: Agencies can use it to show clients why a PHP upgrade is critical, moving beyond abstract warnings to concrete examples of security failures or performance bottlenecks (e.g., showing drastic memory usage differences).
- Development Guide: Petrović plans to expand it into a "pattern library," documenting how to refactor old PHP code to leverage modern, secure practices.
While primarily for developers, the plugin’s visual components can help non-technical stakeholders grasp the very real consequences of outdated software. It underscores that while WordPress’s built-in security measures (escaping, sanitization) remain crucial, they are augmented by the foundational security enhancements provided by modern PHP.
A Call to Action: Gradual Modernization for a Secure Future
The conversation culminated in a clear call for a community-wide shift towards faster PHP adoption. Petrović advocated for WordPress to "lead the charge" by gradually raising its minimum PHP requirements, perhaps to PHP 8.0 or 8.1, even if it’s a multi-year process. This move would not only enable WordPress Core to modernize its own codebase but also exert pressure on hosting companies and plugin developers to follow suit.
The path to modernization, however, doesn’t have to be an abrupt, all-at-once overhaul. Petrović emphasized a gradual approach:
- Start Small: Begin by implementing stricter typing or replacing old functions with newer, more secure alternatives.
- Incremental Updates: Update parts of the codebase over time, one attribute, one plugin, one function at a time.
- Continuous Learning: Developers should regularly consult resources like the official PHP website for upcoming features and changes.
The benefits are undeniable: enhanced security against a growing landscape of threats, significant performance improvements resulting in faster, more responsive websites, and greater resource efficiency for hosting providers. While the challenge of migrating millions of websites is substantial, the risks of inaction are far greater. The collective effort of the WordPress community—from core developers and hosting providers to plugin authors and end-users—is essential to ensure that WordPress remains a secure, high-performing, and future-proof platform for years to come. Milan Petrović’s insights serve as a critical reminder that a proactive approach to PHP upgrades is not merely good practice, but a fundamental imperative for the health and security of the entire WordPress ecosystem.
