End of life (EOL) means the makers have stopped looking after a version of software. It still works, but it no longer gets updates, not even security fixes. For a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site, that is the point where the language underneath your website stops being looked after.
What is end of life?
The software keeps running after that date, but problems found later stay open.
Every PHP branch has a planned life. It starts with active supportActive support is the phase in which a PHP version is fully looked after: both ordinary bugs and security problems get fixed, with regular updates., continues with security supportSecurity support is a phase in which a PHP version only gets fixes for security problems. Ordinary bugs are no longer repaired. and then ends. After the final date the PHP project no longer releases patches for that PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing., even for serious problems. Other software works the same way: WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits., plugins, operating systems and databases all have their own end dates.
The date is not a switch that turns your site off. It is the date after which new weaknesses stay unfixed, which is why EOL software deserves attention before the date, not after.
Not the same as hacked
An EOL version is not automatically vulnerable, and a site on one is not automatically compromised. The accurate statement is that it no longer gets security fixes and can be exposed to new vulnerabilities as they are found. Older weaknesses were fixed while the branch was supported.
What EOL means for a PHP or WordPress site
The practical effect shows up when a serious vulnerability is announced. On October 21, 2026, the PHP project released fixes for two critical vulnerabilities in PHP 8.2 to 8.5. The older versions are not listed in the CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. records. Still, the PHP security team published minimal source patches for PHP 7.4, 8.0 and 8.1, and php.net advises to treat those versions as affected. If you are on one of them, you rely on a backportA backport takes a fix made for a newer version of software and applies it to an older version, so the old one gets the fix without a full upgrade. from your host or distribution, or you have to upgrade.
For that reason, hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. providers and security checks flag EOL PHP. An EOL version can also block newer plugins that need a modern branch, which pushes the upgrade later and makes it bigger.
How to check whether you are EOL
Find your full PHP version in your hosting panel and compare it with the table on php.net/supported-versions.php. Per the table read on October 21, 2026, PHP 8.1 and 8.0 are end of life. PHP 8.2 and 8.3 reach the end of security support on December 31, 2026 and December 31, 2027. PHP 8.4 and 8.5 are supported into 2028 and 2029.
The free PHP exposure check shows the version your site reveals from the outside, which is often the quickest way to see where you stand.
When to act
Act as soon as you are on an EOL branch, and plan ahead when your branch has less than a year of security support left. Updating to a supported branch is the cleanest fix, and we update PHP in WordPress with a backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. and a stagingA staging environment is a private copy of your website where you try updates first, so any mistakes happen there and not on the live site. test. If the site is old, heavily customized or built on plugins that no longer exist, a PHP migration service to a modern stack can be the better route.
Frequently asked questions
Does end of life mean my site is hacked?
No. It means the makers stopped releasing fixes. Your site keeps working, but it can be exposed to new vulnerabilities that will not be patched for that version.
Which PHP versions are end of life?
According to php.net, PHP 8.1 and 8.0 are end of life, and so are the 7.x branches. PHP 8.2 and 8.3 only get security fixes, until December 31, 2026 and December 31, 2027.
Can an end-of-life PHP version still be safe?
Some Linux distributions and LTS vendors ship their own backported fixes for older PHP versions. That can reduce the risk, but it depends on the vendor and is not the same as support from the PHP project.
What should I do when my PHP version reaches end of life?
Plan an update to a supported branch, test it on a copy of your site and then switch. If you cannot update, ask your host or vendor which fixes they still provide.