WP Tavern published a Jukebox podcast episode with Milan Petrovic about a topic many WordPress site owners only notice when something breaks: the PHP version on the server. The practical message is simple enough: if your site still runs PHP 7.x or older, this is not just a dusty technical detail. It can affect security, performance, and how well your WordPress or WooCommerce site survives the next round of automated attacks.
Key Takeaways
- Check whether your WordPress site still runs PHP 7.x, PHP 5, or PHP 8.x.
- PHP 7.4 reached end of life four and a half years ago, according to the WP Tavern interview.
- Old PHP versions still have thousands of confirmed bugs that will not be fixed.
- PHP 8 can improve security, reduce memory usage, and make sites faster.
- Upgrade carefully: back up, test on staging, then move to a supported PHP 8.x version.
What Milan Petrovic said
Petrovic has worked in the WordPress ecosystem since 2007, building plugins and especially bbPress extensions, and now works as a full stack developer at Freemius. The WP Tavern episode follows his WordCamp Europe talk, Secure by Design: Hardening Plugins with PHP 8.x, where he focused on how modern PHP can help developers reduce security risks instead of constantly patching around old patterns.
Why old PHP versions are a problem
The uncomfortable part: the episode says PHP 7.4 reached end of life four and a half years ago, while WordPress Core still supports it. Petrovic also points to PHP 7 and PHP 5 having 3,000 or 4,000 open confirmed bug reports that will never be fixed. Not every bug is a security issue, of course, but leaving a business site on unsupported server software is not exactly a calm security posture.
What PHP 8 changes for WordPress sites
The discussion presents PHP 8 as more than a version number to satisfy a dashboard warning. It brings language-level improvements that can help close security holes, reduce memory usage, and improve speed. Petrovic also introduced a Vulnerability Lab plugin to show how issues such as authentication bypass and server-side request forgery can behave differently across PHP versions. In plain English: the server layer matters.
Who should care
This affects WordPress site owners, WooCommerce stores, agencies maintaining older client sites, and anyone using cheap or outdated hosting where PHP upgrades have been quietly ignored. If the site “still works”, that only proves it still loads. It does not prove that the stack is supported, patched, or ready for current plugin and theme requirements.
What to do next
Start by checking the PHP version in your hosting panel or WordPress Site Health. If you see PHP 7.x or anything older, plan the move rather than clicking randomly at 5pm on a Friday. Make a full backup, test the site on staging, check critical plugins, theme code, checkout, forms, and admin workflows, then upgrade to a supported PHP 8.x version. One update, one plugin, one test at a time – boring, but much cheaper than incident cleanup.
Source and further reading
For broader context on PHP choices in WordPress, see our guide Choosing the Right PHP Version for WordPress Site and our earlier coverage Legacy PHP Risks in WordPress: Why Upgrading to PHP 8 is Essential.
For the full context, listen to or read the WP Tavern episode: Milan Petrovic on the Risks of Legacy PHP in WordPress and Why Upgrading Matters for Security. It is worth checking the source before making hosting changes, especially if you maintain several client sites or an older WooCommerce store.
Frequently Asked Questions
How can I check if my WordPress site is still using old PHP?
Start by checking the PHP version in your hosting panel or in WordPress Site Health. If it shows PHP 7.x or older, the article recommends planning a controlled upgrade.
Why is PHP 7.4 a concern for WordPress sites?
The WP Tavern episode says PHP 7.4 reached end of life four and a half years ago. That means sites still using it may rely on server software with bugs that will no longer be fixed.
Does PHP 8 help WordPress performance as well as security?
Yes. The discussion presents PHP 8 as improving security while also reducing memory usage and making sites faster.
Is this warning about one specific WordPress vulnerability?
No. The article is about the broader risk of legacy PHP versions, unsupported bugs, and how exploits can behave differently across PHP versions.
What should I test before upgrading WordPress to PHP 8.x?
The article recommends making a full backup, testing on staging, and checking critical plugins, theme code, checkout, forms, and admin workflows before upgrading.