To backpatch PHP is to apply a security fix to an older PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. without moving the whole installation to a newer version.
You may be looking for a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. backport because an old site cannot move to a newer version yet. Your host may say the fix is installed. Start with one question: who can show which fix your website actually uses?
A reassuring answer without installation details leaves that question open.
There are three routes to consider. First, ask about a patched package from your distribution or host. Second, consider building a source patch if you have someone able to maintain that build.
Third, plan an upgrade. Read the definition of a backportA backport takes a fix made for a newer version of software and applies it to an older version, so the old one gets the fix without a full upgrade. if that is the word your provider uses.
Establish what your website uses
Write down the domainA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted., the reported PHP version and the person responsible for hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time.. Use the hosting guides to find the version in your hosting account. Ask the administrator which package serves this specific site.
Keep the date of their answer so an old message about another installation does not become your evidence.
Our facts source says the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1. Some distributions and LTS vendors provide backported fixes. This does not identify the contents of your package.
CISA advises taking systems on PHP 8.1 or older offline until patched or updated. Read the security status for the recorded position.
Route 1: a patched distribution or hosting package
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
Start by asking your current administrator about a suitable package update. Request the full package version, its origin and evidence for the fix. Also ask whether that package is in use for your domain.
The check needs to cover the installation serving visitors, followed by confirmation after any change.
This route fits when someone maintains the package for you and can document its contents. Agree who will make the change and who will check the site. Give them a short list of important tasks, such as signing in, submitting a form and completing a test order.
Ask them to check these on a test copy first.
Next, read how to check the PHP package changelogTo check a PHP package, compare the installed package version with its record of changes and confirmation from the administrator of your website.. Request the relevant entry and its link to the security fix. If the answer is unclear, record the gap instead of marking the issue resolved.
Ask the administrator for a next step. Include the end date of the offered maintenance in your decision.
Route 2: have an administrator build the source patch
For PHP 7.4, 8.0 and 8.1, the facts source describes minimal source patches. These are different from a new release you can select as an ordinary version. Treat this as a route for an administrator who can build, test and maintain a separate PHP installation.
If you only have a hosting panel, take the question to your host.
Have the administrator download from www.php.net and verify the signature using the PHP GPG information. Ask them to build into a separate prefix, meaning a separate location alongside the existing one. Agree a rollbackA rollback means going back to the last version of your website that worked, after an update has gone wrong. plan before switching.
Do not overwrite the working installation during the trial.
Next, have the website checked on a test copy using that build. Keep the source and patch references, verification result and test record. Name the person responsible for future fixes.
If nobody can own that work, choose a route your administrator can support. The article on PHP source backportsA PHP source patch is a change to PHP source code that an administrator incorporates into a custom build before using that installation. helps you prepare that discussion.
Route 3: upgrade to a supported version
Upgrading to a supported PHP version remains the only complete solution for the outdated base. Compare both patch routes with an upgrade plan. Use the supported PHP versions page to choose a target.
Have the administrator test whether your site works on it. Base the decision on that test, the remaining support period and the maintenance someone can actually deliver.
Discuss with your administrator which upgrade your website can support. If hosting or the wider setup also needs changing, discuss a website migration. Ask which parts of the site will be checked and what evidence you will receive.
A planned upgrade is only complete once the changed website has been checked.
Keep the plan small enough to carry out. Start with one test copy. Record which parts need changes and who will make them.
Then agree a time to switch, including rollback and checks afterwards. Keep the patch question open while the upgrade remains a plan rather than a verified change to the site.
Choose evidence and a clear owner
Compare extended supportPHP LTS and ELS describe extended support: ask which old PHP version, repairs and maintenance period a provider actually agrees to cover. and an old scanner resultA PHP scanner may show an old version after an update because the visible version and evidence of an installed fix are different pieces of information. using the same questions. Who supplies the fix? Who checks your website?
Who remains responsible for maintenance? Ask whether your administrator will own the work, as well as whether it is possible. A download without an owner is not a completed maintenance plan.
Record the chosen route and the agreed date for its first step.
Save the decision with the site records and the package confirmation or build report. Schedule another review before the agreed maintenance end date. This gives the next administrator a useful starting point.
If evidence remains missing, discuss those gaps before closing the warning.
Not sure which route fits?
Start with the PHP Exposure Check to see what your site sends publicly. Then use the help form. Include your domain, hosting provider and any answer you already received.
Do not share passwords. Those details help you get a focused assessment of which route can be carried out.
Frequently asked questions
What does backpatch PHP mean?
It means applying a fix to an older PHP version. Request evidence for the package or build serving your site.
How do I patch PHP 7.4?
Ask your host about a documented patched package first. The facts source also records a minimal source patch for PHP 7.4. Building it needs an administrator and a test plan.
Is a PHP backport the same as an upgrade?
No. A backport keeps the older version as its base. An upgrade moves to a different PHP version.
Name a maintenance owner.