5 ms·

"WordPress’ core team stance on bumping the PHP version requirement is two fold: 1. Too many WP users are still on old versions like 5.2 and 5.3 2. They don’t

"WordPress’ core team stance on bumping the PHP version requirement is two fold: 1. Too many WP users are still on old versions like 5.2 and 5.3 2. They don’t care about new "features"" If you really do power 20%+ of the websites out there, do you not perhaps have enough influence to influence a change? I could almost buy this reasoning 6-7 years ago. "If we start requiring PHP 5.1... all our users might flock to something else that still only needs 4.3! We better not push things too much". A large segment of the hosting world caters to the wordpress user (casual and professional) and they will jump to whatever requirements Wordpress puts out. Where are they going to go? No one will want to upset this golden goose. WP, make version 5.0 require PHP 7 and be done with it. People will upgrade. They have no real choice - you've killed most any platform that might be a serious competitor for the next several years.

bretthopper 11y ago
We (the Roots team) have had this same opinion for years now. I feel that WordPress underestimates the power they have. Now WordPress does actually work with a lot of the top hosting companies to get their PHP versions upgraded. They do this quietly but they do talk about it from time to time. But they don't go nearly far enough with this outreach program and by still allowing 5.2 and not setting any deprecation timelines it really hurts their efforts.
- mgkimsal 11y ago
  Interesting to know, but... man... they've got some opportunity with PHP hitting a 7.0 and there not being a WP 5.0 released yet. Upgrading PHP isn't just about using "new features" - WP doesn't even have to use any new stuff, but still require higher versions for security and speed benefits would help move the web forward a lot.
  - paulddraper 11y ago
    I don't think the web needs PHP in order to move forward.
    - mgkimsal 11y ago
      With respect to reducing the number of compromised sites, upgraded PHP installs (and wordpress installs) would do a world of good for everyone.
kalenjohnson 11y ago
You're absolutely correct. However, according to WP core devs, nothing should ever be done to inconvenience the user. Moving to a new version of PHP when apparently, user's who have websites don't even know the name of the language their website is built in, should not be put off by having to upgrade this strange thing. I can't agree enough though, WP can be a huge driving force in making all hosting providers utilize modern versions of PHP. However, instead of using that weight to make a difference, they're completely content to hold PHP back. All at the expense and detriment of the user, in the name of the user.
- mgkimsal 11y ago
  "nothing should ever be done to inconvenience the user." Having sites hacked due to old version of PHP is an inconvenience. Why not just tell everyone to chmod 777 the entire website too, just so they're not inconvenienced? Tongue-in-cheek, of course, but there's a balance to be struck between convenience and security, and I think they're somewhat on the wrong side. I was really mixed on the 'auto-update' wordpress core stuff. While I get it - it keeps some people up to date - it also means my system needs to be left in a state where software can be altered, and that means it can be maliciously altered too. The "moving to a new version when they don't know the language" argument - I don't buy it. Almost everyone I know who has wordpress installed who is not a techie has a host that manages it, or presses a button on a control panel. Pressing another button, or having the host do some more stuff - neither of these are inconveniences that outweigh the security benefits - not just to that site owner, but the rest of the internet.
  - kalenjohnson 11y ago
    Yep... we're on the same page
  - technion 11y ago
    Why not just tell everyone to chmod 777 the entire website I run a cron job on my hosting server that detects clients that have done that. I alert several a week regarding the state of their security. I'm nearly always told they followed some "Wordpress installation guide" they found online and won't be changing it.
Tiksi 11y ago
Breaking compatibility isn't going to force people on 5.2/5.3 to upgrade php, they'll just stop upgrading wordpress.
- kentt 11y ago
  I agree but that is okay. If you have a site where security is irrelevant (or you think you do) then stay on WP 4 and don't upgrade. Let the those who need new features and modern security update. I think it's worse to think you're up to date because your Wordpress install is up to date, but you are hashing with md5 and using php 5.2.
gmays 11y ago
Managed WordPress hosts have solved a part of this problem, but the issue is that the vast majority of WordPress sites are on cheap, shared hosting in unmanaged environments. It's currently up to the users to upgrade their sites, which means versions of PHP and WP don't get upgraded...ever. The only realistic solution would be for hosts to forcibly upgrade customers' sites, which causes significant breakage (even < 1% is thousands and thousands of sites). Is that acceptable? Who's job is it to fix that? Are hosts expected to just eat the churn from customers cancelling? I'm not agreeing or disagreeing, just sharing the reality of the situation.
- mgkimsal 11y ago
  > The only realistic solution would be for hosts to forcibly upgrade customers' sites, They could stop putting new customers on outdated systems, for a start. I routinely still see shared hosting delivering PHP 5.4, in 2015 (last I saw something that jarring). You want to keep people on old stuff? Quanrantine them, and have all new customers going forward on newer stuff, and develop a plan for upgrading. "Guys, yes, you want to keep running PHP 5.3, but for the security of the entire data center, we have to upgrade. You may need to upgrade your wordpress/etc - we'll do what we can to help mitigate problems, but not addressing this means your site is more at risk of becoming hacked".

bretthopper 11y ago

We (the Roots team) have had this same opinion for years now. I feel that WordPress underestimates the power they have. Now WordPress does actually work with a lot of the top hosting companies to get their PHP versions upgraded. They do this quietly but they do talk about it from time to time. But they don't go nearly far enough with this outreach program and by still allowing 5.2 and not setting any deprecation timelines it really hurts their efforts.

mgkimsal 11y ago
Interesting to know, but... man... they've got some opportunity with PHP hitting a 7.0 and there not being a WP 5.0 released yet. Upgrading PHP isn't just about using "new features" - WP doesn't even have to use any new stuff, but still require higher versions for security and speed benefits would help move the web forward a lot.
- paulddraper 11y ago
  I don't think the web needs PHP in order to move forward.
  - mgkimsal 11y ago
    With respect to reducing the number of compromised sites, upgraded PHP installs (and wordpress installs) would do a world of good for everyone.

kalenjohnson 11y ago

You're absolutely correct. However, according to WP core devs, nothing should ever be done to inconvenience the user. Moving to a new version of PHP when apparently, user's who have websites don't even know the name of the language their website is built in, should not be put off by having to upgrade this strange thing. I can't agree enough though, WP can be a huge driving force in making all hosting providers utilize modern versions of PHP. However, instead of using that weight to make a difference, they're completely content to hold PHP back. All at the expense and detriment of the user, in the name of the user.

mgkimsal 11y ago
"nothing should ever be done to inconvenience the user." Having sites hacked due to old version of PHP is an inconvenience. Why not just tell everyone to chmod 777 the entire website too, just so they're not inconvenienced? Tongue-in-cheek, of course, but there's a balance to be struck between convenience and security, and I think they're somewhat on the wrong side. I was really mixed on the 'auto-update' wordpress core stuff. While I get it - it keeps some people up to date - it also means my system needs to be left in a state where software can be altered, and that means it can be maliciously altered too. The "moving to a new version when they don't know the language" argument - I don't buy it. Almost everyone I know who has wordpress installed who is not a techie has a host that manages it, or presses a button on a control panel. Pressing another button, or having the host do some more stuff - neither of these are inconveniences that outweigh the security benefits - not just to that site owner, but the rest of the internet.
- kalenjohnson 11y ago
  Yep... we're on the same page
- technion 11y ago
  Why not just tell everyone to chmod 777 the entire website I run a cron job on my hosting server that detects clients that have done that. I alert several a week regarding the state of their security. I'm nearly always told they followed some "Wordpress installation guide" they found online and won't be changing it.

Tiksi 11y ago

Breaking compatibility isn't going to force people on 5.2/5.3 to upgrade php, they'll just stop upgrading wordpress.

kentt 11y ago
I agree but that is okay. If you have a site where security is irrelevant (or you think you do) then stay on WP 4 and don't upgrade. Let the those who need new features and modern security update. I think it's worse to think you're up to date because your Wordpress install is up to date, but you are hashing with md5 and using php 5.2.

gmays 11y ago

Managed WordPress hosts have solved a part of this problem, but the issue is that the vast majority of WordPress sites are on cheap, shared hosting in unmanaged environments. It's currently up to the users to upgrade their sites, which means versions of PHP and WP don't get upgraded...ever. The only realistic solution would be for hosts to forcibly upgrade customers' sites, which causes significant breakage (even < 1% is thousands and thousands of sites). Is that acceptable? Who's job is it to fix that? Are hosts expected to just eat the churn from customers cancelling? I'm not agreeing or disagreeing, just sharing the reality of the situation.

mgkimsal 11y ago
> The only realistic solution would be for hosts to forcibly upgrade customers' sites, They could stop putting new customers on outdated systems, for a start. I routinely still see shared hosting delivering PHP 5.4, in 2015 (last I saw something that jarring). You want to keep people on old stuff? Quanrantine them, and have all new customers going forward on newer stuff, and develop a plan for upgrading. "Guys, yes, you want to keep running PHP 5.3, but for the security of the entire data center, we have to upgrade. You may need to upgrade your wordpress/etc - we'll do what we can to help mitigate problems, but not addressing this means your site is more at risk of becoming hacked".