How many WordPress sites will be on end-of-life PHP on January 1?

The short answer

WordPress.org’s own statistics show that about a third of WordPress sites (34% as of October 24, 2026) run PHP older than 8.2, versions that no longer get official security fixes. Counting PHP 8.2, which reaches end of life on December 31, 2026, the figure is about 58% (source: WordPress.org statistics). So unless they upgrade, more than half of WordPress sites will be on a PHP version without official security fixes on January 1, 2027. That isn’t the same as “unpatched”: hosts and distributions can carry fixes under old version numbers (source: AlmaLinux). But it does mean the next PHP flaw will reach those sites without an official fix.

The numbers

Two populations, one direction. WordPress.org counts WordPress sites that report to it. W3Techs counts websites whose PHP version is visible from outside. The figures differ, and both point the same way.

How we calculated it

WordPress.org. WordPress.org publishes the PHP version share of WordPress sites. We add up every branch below 8.2 for “today”, then add 8.2 itself for January 1, 2027 (source: WordPress.org statistics). You can reproduce the first figure in one line:

curl -s https://api.wordpress.org/stats/php/1.0/ \
  | jq '[to_entries[] | select((.key|tonumber) < 8.2) | .value] | add'

W3Techs. For all PHP websites that reveal their version, we combine W3Techs’s major-version shares with the PHP 8 breakdown (8.0 and 8.1 are end-of-life), then add 8.2 (source: W3Techs). The full method is on /sources.

What the numbers don’t say

• They don’t say these sites are unpatched. Many hosts and Linux distributions ship fixes as backports that keep the old version number (source: AlmaLinux). A site on 7.4 at a careful host may carry the PHP2Shell fix. The figures measure exposure to future flaws, not today’s patch status.
• They may overstate it. The W3Techs figure counts only sites that reveal their PHP version, and well-maintained sites often hide it (source: W3Techs).
• They’re a snapshot. These are live statistics. We re-check them before each update to this post, and the date is on every figure.

Why the runtime lags while WordPress doesn’t

WordPress itself is mostly up to date: about 63% of sites run the latest major version, thanks to automatic updates. The PHP version underneath is set by the hosting environment, and that’s where sites fall behind. WordPress auto-updates don’t change it (source: WordPress.org version statistics). So the fix isn’t another WordPress update. Someone has to switch the runtime: you, your developer or your host.

The same lag shows up beyond WordPress. Bitsight’s internet-wide scans found that PHP 7.4, which got no official fixed release for PHP2Shell, was the most common branch among PHP instances with an identifiable version (source: Bitsight).

What this means for you

1. Find out which PHP your site runs, and who controls it.
2. If it’s 8.2 or older, plan the move to 8.4 or 8.5 now. PHP 8.4 receives security fixes until December 31, 2028, and 8.5 until December 31, 2029 (source: php.net supported versions).
3. Leave time to test. Old plugins and themes are where upgrades break. The PHP 8.2 checklist covers the steps, and sites still on 7.4 can follow the 7.4 to 8.4 guide.
4. Agencies: if your portfolio looks like WordPress overall, most of your clients need this. Batch them with the triage guide.

Sourced facts

Full wording, primary sources and dates: /sources.

Know what your upgrade involves