PHP hosting checklist: versions, extensions and settings to check before you buy
TL;DR: "PHP hosting" tells you almost nothing. Before you buy, check five things: which PHP branches the host offers, whether the extensions your app needs are installed, how PHP runs (PHP-FPM or LiteSpeed rather than mod_php), whether you can choose a version per site, and how quickly the host applies security releases. As of late October 2026 the supported branches are 8.2 to 8.5, and the 21 October security releases make patch speed a deciding factor.
Which PHP versions are supported right now
The PHP project supports each release for two years of active fixes followed by two years of security-only fixes. On the published schedule, the position at the end of October 2026 is:
| Branch | Support stage | Security fixes end |
|---|---|---|
| 8.5 | Active support | 31 December 2029 |
| 8.4 | Active support until 31 December 2026 | 31 December 2028 |
| 8.3 | Security fixes only | 31 December 2027 |
| 8.2 | Security fixes only | 31 December 2026 |
| 8.1 and older | No upstream support | Ended |
Two critical security flaws, nicknamed PHP2Shell, were patched on 21 October 2026. Reporting on the advisory lists the fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so confirm the exact versions against the official PHP announcement. Older branches get at best a minimal backport, which is another reason to avoid them. The full story is in our PHP2Shell guide.
Check 1: versions on offer
A host should offer at least PHP 8.3 and 8.4, and ideally 8.5. Be wary of three patterns:
- A single fixed PHP version for the whole server
- A version list that stops at 7.4 or 8.0
- Old branches shown as "supported" with no note on security status
You rarely want the newest branch on day one for a site with many plugins. The sweet spot for most WordPress and WooCommerce sites is the newest branch your plugins and theme explicitly support, which today usually means 8.3 or 8.4. Confirm compatibility on a copy of the site first, as covered in our staging environment guide.
Check 2: extensions
WordPress and WooCommerce work with a modest set of extensions, but a missing one causes confusing errors. Make sure the host provides, or lets you enable:
mysqliandcurldom,xmlandmbstringopenssl,sodiumandhashzip,fileinfoandexifgdorimagickfor image handlingintlfor internationalisation- OPcache, enabled and sized sensibly
If you run other software, add its needs. Laravel, for example, expects a specific set, which we list in our Laravel hosting guide. The easiest way to check on a live account is a Site Health report in WordPress, or a phpinfo() page you delete straight afterwards.
Check 3: how PHP runs
The handler controls speed, isolation and, as it turns out, risk.
- PHP-FPM runs PHP as separate pool processes, lets each account have its own settings, and is the standard on modern stacks.
- LiteSpeed (LSAPI) is a fast alternative that works well with WordPress caching.
- mod_php runs PHP inside the Apache process. It is older, shares more state and, according to the PHP team's assessment of the October flaws, carries the highest risk because an unauthenticated request can trigger the attack before any application code runs.
If a host runs mod_php, ask whether they plan to move off it. For a comparison of web servers see LiteSpeed vs Nginx vs Apache.
Check 4: version control per site
If you run several sites, you want to set the PHP version per site, not once for the whole account. That lets you upgrade a simple brochure site immediately and hold back a complex store until its plugins catch up. Look for a version selector in the control panel and the ability to change it without a support ticket.
A related feature is per-site php.ini or .user.ini overrides for values such as upload size. Memory and execution limits are a separate topic, covered in our post on fixing the allowed memory size error.
Check 5: patch speed
Security releases make this the most important check of the five. PHP flaws live in the runtime, so you cannot fix them with a plugin or by updating WordPress. Only the host can roll out the patched build on shared and managed plans.
Ask directly:
- How quickly do you deploy PHP security releases, and do you announce them?
- Which patched build is running on my plan right now?
- Do you backport fixes for any older branches you still offer?
A host that answers specifically and quickly is telling you how it treats security in general. A vague answer is a warning sign.
Questions to send a host before you buy
- Which PHP branches can I select, and which patched builds are installed today?
- Is the version selectable per site, and can I change it myself?
- Which extensions are enabled, and can I request others?
- Is PHP-FPM or LiteSpeed used, or mod_php?
- Are OPcache and a recent MySQL or MariaDB version available?
- How are security releases scheduled and announced?
If you are weighing providers more broadly, our checklist for choosing web hosting in India covers the non-PHP factors.
FAQs
Which PHP version should I choose for WordPress today?
Pick the newest branch that your theme and plugins explicitly support, usually 8.3 or 8.4, on a patched build. Test on staging before switching a live store.
Is PHP 8.1 still safe to use?
It no longer receives upstream support, so you rely on a host's backports at best. Plan an upgrade rather than staying on it.
Does a newer PHP version make my site faster?
Often yes, modestly. Each release has improved performance, but caching, hosting quality and database speed usually matter more.
What is the difference between PHP-FPM and mod_php?
PHP-FPM runs PHP in separate worker pools with per-account settings, while mod_php embeds PHP in Apache. PHP-FPM is the modern standard and offers better isolation.
How do I check which PHP version my site uses?
In WordPress, open Tools, then Site Health, then Info, and expand the Server section. Your hosting panel also shows it.
Can I run different PHP versions for different sites on one account?
On most good hosts, yes, through a per-site version selector. If you cannot, expect to be held back by your oldest site.
Why do plugins break after a PHP upgrade?
Older plugins may use removed or changed features. Update everything first, test on staging and check the error log, then upgrade.
Conclusion
Good PHP hosting is a short list: current supported branches, the right extensions, PHP-FPM or LiteSpeed, a per-site version selector and a host that patches quickly. With the October security releases fresh, patch speed deserves the most weight of the five.
HostCloud keeps PHP builds current at the server level so your sites are not waiting on you to chase patches. See the hosting plans at https://hostcloud.in.
Sources: