The PHP developers (php.net) only support each PHP version for a limited period. Once support expires, new security vulnerabilities in that version are no longer patched. However, many websites are built on older code that does not run on newer PHP versions. The CloudLinux HardenedPHP solution addresses this situation.

What is HardenedPHP?

On our cPanel and WordPress hosting plans, PHP versions are provided by the alt-php packages maintained by CloudLinux. CloudLinux (and its partner, TuxCare) continue to patch these even if the relevant version is no longer supported by php.net: fixes for known security vulnerabilities are incorporated into older versions as well. This is known as HardenedPHP.

In the patched package, the PHP version number remains unchanged; only the package’s internal build number changes. Consequently, monitoring tools that only check the version number may incorrectly flag a vulnerability. Our post on the PHP2Shell vulnerability also addresses this issue. If you receive such a notification, please contact us and we will investigate.

So can I just stick with the old version?

HardenedPHP protects against security vulnerabilities within PHP, but it does not solve everything:

• It does not fix the website’s code. Most hacks do not occur because of a PHP bug, but because of an outdated CMS, plugin or template. Websites stuck on an old version of PHP typically remain there because of old, unpatched plugins.
• Slower. Versions of PHP 8 are significantly faster than versions 7 and 5, which means faster page loading and lower resource usage.
• New software will not run on it. New versions of WordPress, WooCommerce and most plugins require increasingly newer versions of PHP, so the old version also prevents updates.

HardenedPHP therefore gives you time to update, but does not replace the update itself.

What do we recommend?

1. Use the latest version of PHP, on which your website will run flawlessly.
2. If the site requires an older version, update the CMS and plugins, then try running it on a newer version of PHP. In the case of WordPress, you can do this safely on a test site.
3. You can revert to the previous PHP version at any time via the cPanel Select PHP Version interface if you encounter problems with the newer version; see: Changing the default PHP version.
4. If an older application cannot be updated, you can set the PHP version on a per-directory basis, so that only that one application runs on the older version.

After upgrading to the new version, please also check the required PHP extensions and settings, as these are stored separately for each version.