Your website still opens. Customers can browse your services, and the homepage looks much the same as it did last year. That tells you very little about whether the software behind it is still supported.
An outdated PHP website can leave a business exposed to security flaws and make routine updates difficult. If old code or abandoned plugins keep preventing upgrades, website migration deserves a place in the budget.
PHP itself is still actively maintained. A supported, well-managed PHP site can be a sensible choice. The warning sign is a website your business depends on but can no longer keep current.
What is a PHP website?
PHP is software that runs on a web server. It can generate pages, process forms and work with a database. WordPress uses PHP, as do many custom-built websites and other content management systems.
You don't need to understand the code to own the site. You do need to know who maintains it, which version it runs and what happens when that version needs replacing.
WordPress itself warns that older software can remain compatible while exposing a site to security vulnerabilities. Being able to run the website is a different test from keeping it supported. WordPress requirements
Why outdated PHP creates security risks
PHP releases have a support window. Once a version reaches end of life, routine support from the PHP project stops. Problems discovered later may remain unfixed on that version.
As of 3 November 2026, PHP 8.1 and earlier are outside the project's regular support window. PHP 8.2 receives security support until 31 December 2026, so businesses using it need an upgrade plan. Check the official PHP support schedule against the version serving your live website.
The full version matters too. On 21 October 2026, PHP released fixes for two critical vulnerabilities that could let an attacker run code on a server without logging in. Ask your host to confirm that the live site has the applicable fixes and subsequent security updates. A response that says only “you're on PHP 8” isn't enough. Some hosting vendors supply fixes for older versions, but that coverage needs confirming. PHP security advisory
Deal with an urgent security update now. A future rebuild won't protect the website that's running today.
PHP is only one part of the check
The CMS, plugins, custom code, database and hosting environment need attention as well. Updating PHP doesn't repair an abandoned plugin or remove a former supplier's access.
OWASP identifies unsupported components, delayed patching and missing compatibility checks as security risks. Depending on the flaw and the access it gives an attacker, a compromise can affect site content, customer information or availability. OWASP guidance on outdated components
For a business, the consequences can include lost enquiries, recovery work and time spent explaining what happened to customers. You don't need to predict a breach to justify checking the setup.
Signs your website needs attention
Ask whoever maintains the site to investigate if any of these sound familiar.
- Your host has sent an unsupported PHP or end-of-life warning.
- Updates are postponed because a theme, plugin or custom feature breaks.
- The original developer has left, and nobody has documented the code.
- Nobody can confirm when a backup was last restored successfully.
- Your team avoids editing the site because ordinary changes cause problems.
- Repairs keep returning without a plan to remove the underlying cause.
These are reasons to investigate, not proof the site has been hacked. Even a site with no visible problems needs someone responsible for updates and recovery. WordPress's security guidance covers this shared responsibility between the site owner and host.
A useful first request is simple. Ask your provider for the current PHP version, its support deadline, the status of security updates and any software blocking the next upgrade. Get the answer in writing.
Should you upgrade PHP or migrate the website?
An upgrade makes sense when the current website still meets your needs and its software can run on a supported version. Test the change on a private copy, check the important customer actions and keep a recovery plan before changing production.
Migration becomes a stronger option when keeping the site supported requires substantial rebuilding anyway.
Imagine a service business whose old enquiry plugin only works on an unsupported PHP version. Replacing that plugin may solve the problem. If the theme, booking connection and custom code have the same limitation, compare the total repair cost with a replacement that removes those dependencies.
Include the next few years in that comparison. Ask what ongoing hosting, licences and maintenance will cost, how your team will make changes, and whether another developer could take over later.
Moving the same outdated code to a new host doesn't automatically solve its problems. A PHP website migration needs a clear outcome, whether that's a maintained PHP application, a different CMS or a simpler site built around what the business now needs.
What could you switch to?
For a business website built mainly around services, projects and articles, prebuilt pages can be worth considering. Tools such as Astro can generate the pages before a visitor arrives, rather than requiring PHP to generate them on each request. Astro rendering documentation
If the replacement removes the PHP application and its plugins entirely, it also removes those particular components from the public website's maintenance workload. That's a reason to consider the architecture. It isn't a promise that the whole system becomes maintenance-free.
Forms, editing accounts, third-party services and the build tools still need care. Keeping WordPress as a separate editing system also means keeping its PHP maintenance responsibilities.
An online shop or customer portal has different requirements from a service website. Choose the platform around those requirements and the people using it. Your team should be able to publish a project or change a service description without needing a developer for every edit. Our guide to choosing a CMS explains what to assess.
How do you protect SEO during website migration?
Start by recording the pages, search traffic and enquiries the existing site already brings in. Keep useful content and working URLs wherever possible.
When a URL must change, map it to its relevant replacement and use a permanent server redirect, usually a 301. For example, an old /services.php address could redirect to /services/. Avoid sending unrelated pages to the homepage.
Check page titles, internal links, canonical URLs and indexing settings before launch. Submit the updated sitemap, test redirects and monitor Search Console afterwards. Google recommends keeping redirects for at least a year and warns that rankings can fluctuate during a move. Nobody can honestly guarantee unchanged rankings. Google's site migration guidance
The launch also needs a business test. Submit an enquiry and confirm it arrives. Complete any booking or purchase flow. Check the analytics recording those actions and agree how to restore the previous version if something important fails.
Our website redesign checklist covers the wider preparation.
Common questions about PHP website migration
Does moving away from PHP mean losing my domain?
You can normally keep your domain while changing the website behind it. If your email shares the hosting account, include it in the plan before cancelling anything. Website hosting and email need to be accounted for separately.
Can we keep the content and design?
Useful content, images and parts of the design can often stay. The code and plugins may need replacing. Decide what to retain before pricing the migration, especially if customers already know where to find things.
Will a new website need ongoing maintenance?
Yes. The work changes with the platform, but someone still needs to manage access, dependencies and connected services. Agree who handles that work and what it costs before launch.
Planning a move from an old PHP website?
Paak can help assess your current website and plan the migration, including the new build, content transfer, editing setup and technical search foundations. We'll look at what needs replacing and what can stay, then agree the scope and cost before work starts.
For businesses in Auckland and across New Zealand, our website design and development service brings that work together. Ongoing support and any deeper SEO work are agreed separately.
Send us your website address and tell us what's prompted the move. A hosting warning, repeated repair bill or feature your team can no longer update is enough to start the conversation.