PHP versions and settings
Many websites, including those built with WordPress, Joomla, Drupal and PrestaShop, run on PHP. The PHP version and a handful of PHP settings affect your site's security, speed and what it can do, such as how large an upload may be. This guide explains what to check, how to change versions without breaking your site, and what the most common settings mean.
What PHP is
PHP is a programming language that runs on the web server. When someone opens a page, PHP code builds the page, often using data from a database, and sends the finished result to the visitor's browser. Visitors never see the PHP code itself.
Why the version matters
New PHP versions are released regularly. Each version receives bug fixes for a period, then security fixes only, and then no fixes at all, which is called end of life. A site on an end-of-life version no longer receives fixes for newly found security problems.
The PHP project publishes the dates for each version on its supported versions page. Check it to see whether your version is still supported.
Newer versions are often faster too. The trade-off is compatibility: old code, themes or plugins may rely on features that newer versions changed or removed.
Check your app's requirements
Before you change versions, check which PHP versions your website app supports. Each app lists them in its official documentation, and the requirements change over time, so look them up rather than relying on older advice. Check your themes, plugins, extensions or modules as well, since an outdated one is a common cause of errors after a switch.
Switch versions safely
The place to change the PHP version depends on your host. Look in your hosting control panel or account for a section about PHP or software versions.
- Update your website app, themes and plugins to their latest versions first. Updates often add support for newer PHP versions.
- Take a backup of your files and database.
- If you have a staging copy of your site, switch it first and test there.
- Change the PHP version for the live site.
- Test the pages and features visitors use: the home page, forms, search, logins, the shopping cart and checkout, and your site's admin area.
- If something breaks, switch back to the previous version and look at the site's error log to find which part caused the problem.
DomainPilot web hosting includes a staging environment from the Business plan, and one-click staging is included on WordPress hosting from WP Grow. A staging copy is a good place to try a new PHP version before switching your live site.
Common PHP settings
PHP has many settings. These are the ones website owners change most often.
| Setting | What it controls | When to raise it |
|---|---|---|
memory_limit | The most memory a single PHP script may use | Errors such as "Allowed memory size exhausted" |
upload_max_filesize | The largest single file that can be uploaded | Media or import files are rejected as too large |
post_max_size | The largest total size of a form submission, including uploads | Must be at least as large as upload_max_filesize |
max_execution_time | How many seconds a script may run before PHP stops it | Long imports or exports time out |
Raise limits only as far as you need. Very high values can let a faulty script use more of your account's resources, see Resource limits on shared hosting.
Where to change settings
How you change PHP settings depends on your host and on how PHP runs on the server. Depending on the setup, you may use:
- a PHP settings section in your hosting control panel or account
- a
.user.iniorphp.inifile in your website's folder php_valuelines in an.htaccessfile, on some Apache servers only
A .user.ini file uses the same format as php.ini:
memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 120
Use only the method your host supports. Adding a line in the wrong place can be ignored, or in the case of .htaccess can cause a 500 error. Some hosts set upper limits you cannot go beyond.
Check the active version and settings
To see which PHP version and settings your site actually uses, create a file named something hard to guess, such as info-7f3k9.php, in your website's document root with this content:
<?php
phpinfo();
Open it in your browser, for example at https://example.com/info-7f3k9.php. The page lists the PHP version at the top and every setting below it. The Local Value column shows what applies to your site.
The phpinfo() page reveals details about your server and setup that help attackers. Delete the file as soon as you have checked what you need.