PHP

PHP is a back-end language: the visitor never downloads PHP code, only the HTML it produces. It handles tasks such as reading content from a database, processing contact forms, managing logins and generating pages. WordPress, Drupal, Joomla and frameworks such as Laravel and Symfony are written in it.

PHP is sometimes described as old-fashioned, but it has been modernised considerably over the years and remains a practical choice. Its biggest advantage for small businesses is availability: almost every hosting plan, including inexpensive shared hosting, runs PHP out of the box.

How it works

When a visitor requests a page, the web server sees that it is handled by a PHP file and passes the request to the PHP engine. The PHP code runs on the server: it might read the page's content from the database, check whether the visitor is logged in and insert the results into a template. The finished HTML is sent to the browser, and the PHP code itself stays on the server.

Each request starts fresh, so PHP sites rely on the database, files and cookies to remember things between page views. To avoid repeating the same work for every visitor, sites use caching, storing finished pages or compiled code so they can be served without running everything again.

PHP is released in versions, and each version receives security fixes for a limited period before it is retired. Hosts let you choose the PHP version for your site, usually from a control panel. Running a retired version means newly discovered security holes are never patched, while moving to a newer version can break old plugins or themes written for earlier ones.

Example

A landscaping company's WordPress site has run untouched for several years on an old PHP version. The host announces it will remove that version. In a staging copy of the site, the developer switches to a current version and finds that one old gallery plugin throws errors.

The plugin has not been updated by its author in years, so it is replaced with a maintained alternative and the galleries are moved over. The live site is then switched to the new PHP version. Pages also load faster afterwards, because newer PHP versions are generally quicker at running the same code. Had the owner waited until the host forced the change, the gallery would have broken on the live site with no warning, and the fix would have been done in a hurry rather than tested.

Why it matters for your business

If your site runs on WordPress or another PHP platform, the PHP version is part of your security. You can check it in your hosting control panel or in WordPress's Site Health screen, which also warns when the version is outdated. Keeping PHP current is usually cheap when done regularly and expensive when left for years, because the jump breaks more at once. PHP's wide availability also keeps hosting costs low and makes developers easy to find, which is a real advantage over less common stacks. A yearly check of the PHP version, alongside plugin updates, is usually enough to stay ahead of forced changes.

Common mistakes

• Running a PHP version that no longer receives security fixes because the site still works.
• Upgrading PHP directly on the live site without testing plugins and themes on a staging copy first.
• Keeping abandoned plugins that block upgrades instead of replacing them.
• Leaving error messages visible to visitors, which can reveal file paths and other details useful to attackers.

Questions people ask

How do I check which PHP version my site uses?

Look in your hosting control panel, where the PHP version or PHP selector is usually listed per domain. On WordPress, the Site Health tool under Tools shows the PHP version and warns if it is out of date or no longer supported.

Is PHP still used?

Yes, very widely. WordPress alone runs a large share of the web, and frameworks such as Laravel are popular for new applications. PHP has improved substantially in speed and features, and it remains one of the most common server-side languages on shared and managed hosting.

Is PHP secure?

PHP itself is secure when kept up to date and used carefully. Most problems come from outdated versions, unmaintained plugins and code that mishandles user input. Current versions, maintained plugins and established frameworks with built-in protections cover the common risks.