Store Sheriff → PHP versions
Which PHP versions still get security fixes?
PHP is the language WooCommerce, PrestaShop and Magento are written in. Every release eventually stops getting security fixes — permanently. If your store is running one of the dead versions below, every vulnerability found in it from now on stays open on your server and no patch is ever coming. This is which versions are safe, which are dying, and what to do if yours is on the wrong list.
Where your version stands
| PHP version | Verdict | What that means for your store |
|---|---|---|
| 8.5 | Current | Bugs and security problems both get fixed. This is where you want to be. |
| 8.4 | Current | Bugs and security problems both get fixed. Perfectly good place to be. |
| 8.3 | Security fixes only | Safe to run. Only security issues get fixed now, not ordinary bugs. Fine for now — but it is on the clock, so plan the move rather than waiting to be surprised. |
| 8.2 | Fix this soon | Security support is about to end. Nothing breaks on the day it does — the store trades exactly as before. What changes is that from then on, every newly found vulnerability stays open on your server with no fix, and nobody tells you. Move while this is still planned work instead of an emergency. |
| 8.1 | Dead | No security fixes, ever again. Deal with this now. |
| 8.0 | Dead | No security fixes, ever again. Years of published vulnerabilities are sitting open. |
| 7.4 | Dead | Badly out of date and a serious problem. Still extremely common on neglected stores, which is exactly why scanners look for it. |
| 7.3 | Dead | Long dead. Treat this as urgent. |
| 7.2 | Dead | Long dead. Treat this as urgent. |
| 7.1 | Dead | Long dead. Treat this as urgent. |
| 7.0 | Dead | Long dead. Treat this as urgent. |
| 5.6 or older | Dead | This is a huge problem. Many years past any support, running a store that takes card details. Nothing about this is safe. |
Support windows move, and this page is only as good as its last update. The authoritative pages are php.net/supported-versions and php.net/eol — if this page and php.net ever disagree, php.net is right.
If you are on PHP 8.1 or below, fix it now
Not this quarter. Now. Those versions get no security fixes of any kind, and the risk is not that your store stops working — it is that a vulnerability gets published, publicly and with details, and automated scanners start trying it against every server on the internet within days. Your store is in that list. No patch is coming, and nobody is going to warn you.
If you are on 8.2, you are not in danger today but you are on a countdown, and the job gets harder the longer it waits. Put it in this quarter's plan.
What the three statuses actually mean
Active support
Ordinary bugs and security issues are both fixed, on a regular release schedule. This is where you want to be.
Security fixes only
Still safe to run. Only security problems get fixed, and only if they are judged serious. Ordinary bugs are not. A branch in this phase is a fine place to sit, as long as you know when it ends.
End of life
Nothing is fixed, ever again, no matter how severe. This is the one that matters, and it is worth being precise about the risk: the danger is not that your store stops working. It is that a vulnerability gets published — publicly, with details — and automated scanners begin trying it against every server on the internet within days. Your store is in that list. There is no patch coming.
Some hosts backport critical fixes to end-of-life PHP themselves. That is genuinely better than nothing, but you are now trusting your host's judgement about which fixes matter, usually without being told what they did or didn't apply. Ask them specifically, in writing, if you are relying on it.
Which PHP version can your store actually run?
This is the part that traps people. You cannot simply move PHP to a supported version — your store software has to support it too, and on older platforms it does not. The intersection is what matters:
| Store platform | PHP it supports | Supported PHP available to you? |
|---|---|---|
| PrestaShop 9.0 | 8.2 – 8.5 (8.4 recommended) | Yes — 8.3, 8.4, 8.5 |
| PrestaShop 8.x | up to 8.1 | No — 8.1 is dead |
| PrestaShop 1.7 | up to 7.4 / 8.1 depending on minor | No |
| WooCommerce 10.8+ | 8.3+ required (tested to 8.4) | Yes |
| Older WooCommerce | works on 7.4+ | Only by upgrading Woo |
| Magento / Adobe Commerce 2.4.7+ | 8.2 / 8.3 depending on patch | Yes, on recent patches |
The PrestaShop rows are the important ones, and they deserve stating plainly: if you run PrestaShop 8, there is no supported version of PHP you are allowed to run. PrestaShop 8 tops out at PHP 8.1, and PHP 8.1 is dead — no security fixes, ever again. The only way out is PrestaShop 9, which requires PHP 8.2 or newer. That is not a configuration change you can make in a hosting panel — it is a platform upgrade.
Full detail per platform, with each vendor's own support dates: is your store platform still supported?
What to do about it
- Find out what you actually run. Your hosting control panel shows the PHP version on its front page. Don't guess — in our experience owners are usually a version or two behind what they believe.
- Check what your store software supports before changing anything. Moving PHP up past what your platform, theme and plugins can handle is the classic way to turn a working store into a blank white page.
- Test on a copy first. Clone the store to staging, switch PHP there, then click through a real purchase. Product page, add to cart, checkout, payment. Errors from a PHP jump often appear only at checkout, which is the one page nobody tests.
- Then switch live, during a quiet hour, with a backup you have actually restored at least once.
- Write down the next end-of-life date and put it in a calendar. It is the one piece of maintenance that is both completely predictable and completely ignored.
If steps 2 and 3 are the ones you can't realistically do yourself, that is the normal reason stores stay on old PHP for years. SwiftForge Web, who build this tool, do exactly that work: their write-up on what end-of-life PHP means for a store explains the reasoning, and a free store review tells you specifically what would break on your store before you touch it.
Sources
- php.net — Supported Versions (release, active-support and security-support dates)
- php.net — Unsupported Branches (end-of-life dates)
- PrestaShop 9 system requirements
- WooCommerce server requirements
- Adobe Commerce lifecycle policy
Everything on this page is copied from those pages, not from memory. If a date here looks wrong, check the source and trust it over us.
Find out what else has drifted
PHP version is one of 18 checks in the free Store Sheriff self-check — alongside backups, plugin hygiene, mobile speed and whether anyone would notice if the store went down. No login, nothing leaves your browser.