Official PHP versions stop receiving security updates a few years after release. Many sites still run on them because an old plugin or custom script would break on a newer version. CloudLinux's hardened PHP (the alt-php builds in PHP Selector) keeps those old versions patched for longer.
Before you start
Nothing to set up: on MdmHost, every version in cPanel → Software → Select PHP Version is a CloudLinux alt-php build (see changing PHP version).
What hardened PHP does
- CloudLinux backports security fixes from current PHP releases into older versions such as 7.4, 7.3 and even 5.x.
- Builds are published as normal updates, so the server stays patched automatically.
- Each version runs inside CageFS, isolated from other accounts (see CageFS explained).
What it does not do
| Hardened PHP helps with | Hardened PHP does not help with |
|---|---|
| Known vulnerabilities in PHP itself | Vulnerabilities in your WordPress plugins, themes or code |
| Keeping old apps online safely for a while | Performance: old PHP versions are slower than PHP 8.x |
| Server-level compliance for PHP patches | Compatibility with new plugins that require PHP 8 |
Why you should still upgrade
- Speed: PHP 8.x runs typical WordPress sites noticeably faster.
- Plugin support: new versions of popular plugins drop support for old PHP, leaving you stuck on outdated, vulnerable plugin versions.
- Developer tooling: current libraries and frameworks need modern PHP.
Tip: Use hardened PHP as a bridge. Pick a date, test the site on PHP 8.2 or 8.3 on a staging copy, fix what breaks, then switch the live site.
How to plan the move
- Update WordPress, plugins and themes to their latest versions first.
- Make a backup or staging copy.
- Switch PHP version in Select PHP Version and test thoroughly.
- Check cPanel → Metrics → Errors for deprecation and fatal errors.
- Replace abandoned plugins that will not run on PHP 8.
Enable any extensions your app needs on the new version (see PHP extensions and options).
Frequently asked questions
Is PHP 7.4 safe on MdmHost?
The PHP engine receives backported fixes through hardened PHP, so it is much safer than an unpatched build. Plugins and code that only run on 7.4 are often the bigger risk.
Does WordPress still run on old PHP?
WordPress supports a range of PHP versions but recommends current ones. Many plugins have stricter requirements.
Where can I see PHP end-of-life dates?
The official php.net supported versions page lists active and security support dates for each version.
Can I tell whether my PHP is hardened?
On CloudLinux, versions chosen in Select PHP Version are alt-php builds from CloudLinux. phpinfo() shows paths under /opt/alt/.
Do I need to do anything to get the patches?
No. The server receives updated alt-php packages through normal system updates managed by MdmHost.
Is native PHP hardened too?
Native means the server's EasyApache PHP, which follows cPanel's own update and end-of-life policy rather than CloudLinux's backports.