PHP runs the application layer of most WordPress and WooCommerce sites. When a PHP release fixes a security flaw, the fix only protects you once the server you actually serve pages from is running it. That makes keeping PHP current one of the more useful routine jobs in hosting.
Know which branches are supported
PHP publishes a supported versions table. Each branch gets a period of active fixes and then a period of security-only fixes. After that it is end of life, and a vulnerability found afterwards is not fixed in that branch at all. Running an end-of-life version is a decision to accept every future flaw in it.
Check what is really serving your site
A server can have several PHP versions installed at once. The version your shell reports is not necessarily the one answering web requests, or the one running scheduled tasks. I check the pool the web server sends requests to, the executable cron calls and the configuration each loads. My note on keeping a rollback route when moving PHP covers how I separate those checks.
Patch releases are the cheap ones
Moving from 8.4.20 to 8.4.21 is a small change, and it is where security fixes usually arrive. Moving to a new minor branch needs more testing, because deprecated features and extensions can change. Doing the patch releases promptly keeps each later jump smaller.
Test, then restart
I apply updates on a staging copy where I can, then check an uncached page, an administrator task, a REST request and the media and background jobs the site relies on. The update only takes effect once PHP-FPM is restarted, so I confirm the new version is live afterwards instead of assuming it.
Keep the rest of the stack in step
PHP is one layer. WordPress core, plugins, themes and the operating system need the same routine. An up-to-date PHP does not make an out-of-date plugin safe, and the reverse is also true.
A short checklist
- Confirm every site is on a branch that still receives security fixes.
- Find any leftover old PHP versions and the sites still using them.
- Apply patch releases as they are published.
- Restart PHP-FPM and verify the running version.
- Check cron and background jobs, not only the front end.
If you are not sure which PHP version your sites really use, or you have sites stuck on an old branch, get in touch and I will take a look.