Does your PHP version matter?

You’ve very likely heard about PHP many times, if you’re running a WordPress site… but, do you know what it is, and why it matters?

PHP is the programming language that WordPress, like most websites, is written in. It has its share of defects, but has the huge positive of being available everywhere. It’s easy and free to learn, there’s a huge ecosystem, and for that reason dominates the world of web applications.

Why care?

Now, you’re thinking “Does this matter? As long as it works, then this isn’t something I need to care about… I’m working much higher up the stack: I install WordPress, install plugins, look after my WordPress dashboard… perhaps I Google for and then copy and paste a few bits of PHP code sometimes when I have a special problem – isn’t that it?”

One issue that WordPress developers and site builders can improve by learning a little bit more about is PHP versions. The full technical history of how PHP got to where it is today is interesting, but that’s not what we mean. What WordPress site owners need to know about is the significance of differences between major PHP versions – so that you can make sure your site is secure, running efficiently, and compatible with plugins you’re likely to want to use.

PHP version numbers

Major PHP versions currently are of this form: 5.x, where x is another whole number. (The first 5.0 version was in 2004, so we’re still going a long way back here!).

WordPress requires at least the 5.2 series of PHP releases to run on (to be more precise, at least 5.2.4). This was released in August 2007, and it’d be all-but-impossible to find a web hosting company offering anything less.

Since the 5.2 series, there have been other major releases: 5.3, 5.4, 5.5 and (in August 2014), 5.6. This version numbering scheme will soon end – the next PHP release is going to be PHP 7 (PHP 6 is being skipped, to avoid some confusion due to ideas for a “PHP 6” from some years ago).

You’re still with us, and not fallen asleep yet? Great… we’re getting to the stuff that matters! What do you need to know?

PHP 5.2

PHP 5.2 reached its official (i.e. according to the PHP group) end-of-life a long time ago – in January 2011. It’s full of known security issues, and if your web hosting company is still offering it as the default setup (sadly, such companies appear to exist), then it’s time to find a less lazy vendor. Honestly: yours doesn’t care. They’re whole years off the pace.

How many WordPress sites still actually run on PHP 5.2 (largely on sites set up years ago, and not upgraded)? The answer is, lots: just under a third. So, plugin authors still (if they want their plugins to run everywhere), have to support PHP 5.2. However, more and more plugin authors will no longer do this, because a) the testing burden is too high – if you’re supporting 5.6, 5.5, 5.4, 5.3, then a version end-of-lifed 4 years ago may be too much, and b) PHP 5.3 brought in a lot of new “good stuff” for developers to use. Coding for compatibility with 5.2 eats your time. (Since UpdraftPlus is a backup plugin, and people want reliability, we will continue to support PHP 5.2 for as long as WordPress does – don’t fear!).

Short summary: if your web server is still running PHP 5.2, then upgrade it now (this might just involve ticking a box in your control panel, or involve talking to your web hosting support to do it for you – it depends; you will need to ask them, if you’re not sure). What’s next?

PHP 5.3

PHP has been hugely popular, mostly because of being the default version installed on the most popular web server operating system (and because the vendor of that system, for a long time, did not provide any easy way to upgrade). PHP 5.3 installs currently account for a further 38.4% of servers that WordPress runs on.

I’ve not yet come across a plugin developer who didn’t support PHP 5.3. If someone doesn’t support at least 5.3, then they’re saying goodbye to 7 in 10 users. So, 5.3 seems a safe choice from this point of view.

However, in fact, PHP 5.3 has also been end-of-lifed, since August 2014. The PHP group will never make any future releases for it. Any security holes found in it will not be repaired, by them. That sounds scary, but isn’t quite as bad as it seems – updates are still being engineered by the operating system vendors for operating systems that included this version. Most webservers run a derivative of Red Hat Enterprise Linux 6, and hence should be covered until November 2020. So, you probably won’t have to worry about the security angle until then.

However, even though developers will officially support PHP 5.3, and testing upon it, they’re not likely to be using it themselves to develop upon (good coders want to keep up with the state of their profession). So, if your website is still running PHP 5.3, then you should consider upgrading – not as a “urgent – now!”, item, but something to get sorted in a timescale of months.

Which brings us to…

PHP 5.4

PHP 5.4 is a currently supported release, and currently used by just under 25% of web servers running WordPress. So, cumulatively, that takes us up to 95%. For this reason, we recommend running PHP 5.4. It’s now growing rapidly, as hosting companies have responded to the PHP 5.3 end-of-life. The changes from PHP 5.4 to 5.5 were quite minor, and is supported by every plugin and theme that exists (AFAIK).

PHP 5.4 also had some nice under-the-hood improvements to its speed and memory usage – the improvement from 5.3 up to 5.4 for normal use-cases appears to be more significant than any others in recent times. So, if you use PHP 5.4, then things run faster, and you get more money from your investment in resources.

It’s not impossible to have problems in PHP 5.4 that you did not have in PHP 5.3 – but, having personally overseen the upgrade of a webserver running over 250 WordPress installs, it’s very unlikely – I saw three WP sites with problems (so, around 1%); each due to a very old plugin that just needed an update to a current version.

At UpdraftPlus.Com, we also recently upgraded from PHP 5.3 to 5.4. Everything went smoothly, apart from having to swap a very low-level “opcode cacheing” extension (something you won’t have, unless you run your own webserver and tune it at a low level). The site immediately ran faster, and used less memory – where before we were pushing some limits, we’ve now returned to a comfortable margin, and can support even more growth.

It’s worth noting, though, that officially PHP 5.4 hits its end-of-life in September of this year! The world of web hosting moves slowly…

PHP 5.5 and 5.6

The pragmatic WordPress site builder doesn’t need to know much about these, yet. PHP 5.5 is just beginning to take off, and is used by 4.2% of WordPress sites. That means that if you decide to use it, then you’re no longer a “canary in the mine” – with WordPress’s massive popularity, 4.2% equates to a gigantic amount of websites. As a bonus, it’s likely that a majority of your plugin developers use this as their default version too (if not 5.6).

5.6 only just appears on the chart, at 0.4% – that’s still a lot of sites, numerically, but you’re choosing to be very leading edge if you’re looking at that already.

These are the official PHP group PHP releases. There are other exciting initiatives going on, which are beginning to deliver alternative PHP setups, with the promise of huge speed increases. These are also very leading edge, if you’re approaching them as a WordPress site builder, and you’ll to invest in a fair amount of research and work to get up to speed with using them, if you’re interested.

So, now you know – PHP versions aren’t something you have to think about a lot, but it’s the engine that runs everything else. It matters, and you can improve your speed, security and compatibility, by making the right choice.

David Anderson (lead developer, founder, UpdraftPlus)