WordPress PHP upgrade, tested on a staging copy first.
We upgrade one WordPress or PHP site, or one Node.js app, to the latest security release on a supported version. We do it on a staging copy first and fix the plugins or packages that break. Then we switch the live site over with a rollback plan ready.
Four reasons people book an upgrade.
Security release
PHP and Node.js shipped critical fixes on 21 October 2026
On a supported branch the fix is a point update, and PHP workers must be restarted to load it. On PHP 8.1 or older, or Node.js 20 or older, there is no project fix: the answer is a move to a supported branch.
End of life
Your branch no longer gets fixes
PHP 8.1 and older get no new releases from the PHP project. PHP 8.2 stops receiving security fixes on 31 December 2026. Node.js 20 reached end of life on 30 April 2026.
Hosting
Your host is retiring the version you run
When a host retires a PHP version, it sets a date. Upgrading a staging copy before then means you find the broken plugin before your visitors do.
Node.js apps
The app, container or build image pins an old Node.js
Updating the server is not enough when Node.js ships inside a Docker image or a build step. We update the version everywhere it is pinned and rebuild.
How to upgrade PHP on a WordPress site safely.
The same steps we follow. If you are comfortable with your hosting panel, you can do this yourself.
- 1. Check the version
- In WordPress, open Tools, then Site Health, then the Info tab, and expand Server. That shows the PHP version serving the site. On a server, php -v reports the command-line PHP, and panels such as cPanel can give each domain its own version, so trust Site Health. For Node.js, run node -v in the app’s environment.
- 2. Pick the target
- Choose a supported branch, then its latest release. Today that means PHP 8.3, 8.4 or 8.5, or Node.js 22 or 24 LTS; the newer the branch, the longer it gets security fixes. Check that your theme and plugins list support for that PHP version.
- 3. Back up and copy
- Take a full backup of files and database, then make a staging copy. Use your host’s staging tool if it has one; if not, a copy on a subdomain works.
- 4. Switch staging
- Change the PHP version on the staging copy only, in your hosting panel. In wp-config.php, turn on WP_DEBUG and WP_DEBUG_LOG and turn off WP_DEBUG_DISPLAY, so warnings go to wp-content/debug.log instead of the screen. Turn them off again when testing is done.
- 5. Test what earns money
- Log in, submit every form, run a test checkout and open the pages that bring in the most traffic. Read the debug log. Update or replace any plugin that throws errors.
- 6. Switch live
- Change the version on the live site at a quiet hour, restart PHP workers and clear caches. Keep the old version selectable so you can switch back quickly.
- 7. Watch the log
- Check the error log and the main flows again over the next few days. Some problems only show up on a scheduled task or a rare page.
Rather hand it over? We do all seven steps for US$499, on PHP or Node.js.
PHP 8.2 end of life, and the other dates that matter.
The last day each branch gets security fixes from its project. After that date, a new vulnerability stays open unless your host or vendor backports the fix.
- PHP 8.1 and older
- Already out of support. PHP 8.1 security fixes ended on 31 December 2025.
- PHP 8.2
- Security fixes only, ending 31 December 2026. Active support ended on 31 December 2024.
- PHP 8.3
- 31 December 2027.
- PHP 8.4
- 31 December 2028.
- PHP 8.5
- 31 December 2029.
- Node.js 20
- Out of support since 30 April 2026.
- Node.js 22 LTS
- 30 April 2027.
- Node.js 24 LTS
- 30 April 2028.
The October 2026 PHP and Node.js security releases.
What the PHP and Node.js projects and CISA had published as of 23 October 2026. Check the sources for anything newer.
- PHP: the bugs
- CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, allow remote code execution. php.net says every PHP install that serves web requests is at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk on mod_php.
- PHP: fixed in
- 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no release from the PHP project: use a backported package from your distribution or LTS vendor, or upgrade. php.net lists configuration changes that block some attack paths, and says only an update is a complete fix.
- CISA
- Its alert says to patch immediately, internet-facing systems first, and to take PHP systems offline if they cannot be updated or still run PHP 8.1 or older. It said it had not observed exploitation at the time of publication.
- Node.js
- Security releases for the 22.x, 24.x and 26.x lines, with four High-severity CVEs, including a Brotli decoder flaw that permits remote code execution. Fixed in 22.23.4, 24.22.1 and 26.12.1. nodejs.org says end-of-life versions are always affected when a security release occurs.
From access to a patched site in 3 business days.
Pay, or ask first
Pay US$499 by card, or send a question with your site or repository link. We reply within one business day with the access we need.
Upgrade on a staging copy
We back up, copy the site or app, move the copy to the new version and fix what breaks, up to 4 hours of fixes. We test the main user flows before anything touches the live site.
Switch over, then hand over
We switch the live site at an agreed time with the rollback plan ready. You get handover notes, a 7-day rollback window and 14 days of fixes for anything the upgrade broke.
Get the site onto a patched version.
US$499 fixed for one site or app. If it is bigger than one site or app, or needs more than 4 hours of fixes and you decide not to go ahead, you get a full refund.
US$499 for one site or app, with a rollback plan.
US$499
Fixed, for one site or one app in one repository, on PHP or Node.js.
- Turnaround
- Upgraded and switched over in 3 business days after we have access
- After the switch
- A 7-day window to roll back, and 14 days in which we fix any regression the upgrade caused, at no charge
- Payment
- Pay by card online, or ask first. Full refund if the job is bigger than one site or app, or needs more than 4 hours of fixes and you decide not to go ahead
What the upgrade includes
- A backup and a staging copy of the site or app before anything changes
- A compatibility check of the theme, plugins, Composer or npm packages and the lockfile
- Up to 4 hours of fixes for what the new version breaks
- The move to the latest security release on a supported version: PHP 8.4 or 8.5 (8.3 if a plugin blocks them), or Node.js 24 LTS (22 if a dependency blocks 24)
- A test of the main user flows on staging, then the switchover with a written rollback plan
- Handover notes: what changed, what we tested and how to roll back
If the compatibility check shows more than 4 hours of fixes, we tell you before doing extra work and give you a fixed quote for it. If you would rather not go ahead, or the job is bigger than one site or app, we refund in full. Hosting moves, malware cleanup and rewrites are separate jobs.
What we need from you once you book.
- Hosting access
- A hosting panel login, or SSH access to the server. For Node.js apps, access to wherever the app is built and deployed.
- Site or code access
- A WordPress admin account for WordPress sites, or the repository for custom PHP and Node.js apps.
- Your main flows
- A short list of what must keep working: logins, forms, checkout, bookings, scheduled emails.
- A switchover time
- When traffic is low for you, so the live switch happens at a quiet hour.
Send access through the channel we give you after payment. Do not put passwords in the contact form.
A patched site and a record of what changed.
- The site or app on the latest security release of a supported branch
- A backup taken before the switch and a written rollback plan: back to the old version where the host still offers it, or a restore of the files from the backup
- Handover notes: versions before and after, what we changed, what we tested
- Fixes for anything the upgrade broke, for 14 days after the switch
- A note of anything we saw but did not touch, such as plugins with no update
Site owners, agencies and teams in the US, UK, EU and Australia.
For anyone running a WordPress or PHP site, or a Node.js app, on a version that is out of date or out of support. Rai Ansar, who does the work, has been a developer and DevOps engineer since 2019. His record includes 500+ websites optimized and 700+ migrated without downtime.
If a custom app needs a larger rewrite than an upgrade, start with a US$399 code audit instead.
Want to see what we have built? Browse our selected work.
Questions we get before people start.
How much does a WordPress PHP upgrade cost?
US$499 fixed for one site or one app, including up to 4 hours of fixes. If the compatibility check shows more, you get a fixed quote for the extra work before we do it. If you would rather not go ahead, or the job is bigger than one site or app, we refund in full.
Which PHP version should I upgrade to?
The latest release of a supported branch. We aim for PHP 8.4 or 8.5, which get security fixes until 31 December 2028 and 31 December 2029, provided the theme and plugins support them. PHP 8.2 stops getting security fixes on 31 December 2026, so a move to 8.2 means another upgrade before the year is out.
Is PHP 8.1 still safe to run?
The PHP project no longer releases fixes for 8.1 or older. Some Linux distributions and LTS vendors backport fixes into their own packages, so ask your host whether yours does. Otherwise, upgrade. CISA’s 21 October 2026 alert says to take PHP systems offline if they cannot be updated or still run 8.1 or older.
My host says PHP is patched, but the version number looks old. Why?
Distributions such as Debian and Red Hat backport security fixes into the version they shipped instead of moving to a newer release, so an old version number can still include the fixes. Ask the host for the exact package version and whether it covers CVE-2026-109618 and CVE-2026-109619.
Will upgrading PHP break my WordPress site?
It can. A theme or plugin that was never updated for the new PHP version is the usual cause. That is why we upgrade a staging copy first, fix what breaks there, and keep a backup and a rollback plan ready until the live switch has held.
Do you upgrade Node.js apps too?
Yes. We move the app to Node.js 24 LTS, or 22 if a dependency blocks 24, update the version wherever it is pinned (servers, Dockerfiles, CI and build images) and rebuild. For Next.js apps we also check the lockfile, including the sharp image library.
How long does it take?
Upgraded and switched over in 3 business days after we have access. The live switch happens at a time you agree.
What is not included?
Moving to a new host, malware cleanup, and rewrites beyond the included 4 hours of fixes. We quote those separately before doing any extra work.
Move to a patched, supported version.
US$499 fixed for one site or app, tested on a staging copy first, with a rollback plan and handover notes.