Move off end-of-life software on WordPress

Why it matters

The software versions named in the finding no longer get security fixes from their vendor or from any long-term distribution, so every hole found from now on stays open. Moving to a supported release is the only fix; hiding the version number does not help.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. In the hosting panel, check which PHP versions you can choose and which one the site uses. Update WordPress, the theme and all plugins first, because old plugins are what usually breaks on a newer PHP.
2. Make a staging copy (most hosts offer one), switch the staging copy to a supported PHP version, and test the site. Fix or replace what breaks, then switch the live site.
3. If the web server or operating system itself is end of life and the host cannot upgrade it, move the site to a plan or host on a supported system. A migration plugin or the host's own migration service can copy the site.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cms and framework advisories check
• Keep the software named in the finding up to date
• Update the CMS or application to a patched release
• Patch the exploited vulnerability in your CMS or application
• Update WordPress to the current release