SSL Dragon warns WordPress stores to upgrade PHP before the holidays

SSL Dragon says WordPress stores on PHP 8.2 face a year-end security crunch as PHP support ends December 31, 2026 and holiday shopping traffic peaks. The company points to backup, malware-scanning and trust tools as ways to reduce upgrade risk before unsupported software spills into 2027.

Why it matters: - WordPress stores that stay on PHP 8.2 after December 31, 2026 will move into unsupported software during a period when US online holiday sales are projected to hit $275.1 billion. - Unsupported PHP no longer receives fixes for newly found flaws, which increases security and checkout risk for ecommerce sites. - Baymard Institute’s 2026 survey found 19% of US online shoppers abandoned a purchase in the previous three months because they did not trust the site with their credit card information.

What happened: - SSL Dragon, a San Jose-based provider of SSL certificates and digital security solutions, warned that WordPress stores need to upgrade PHP before the holiday rush or carry unsupported software into 2027. - Adobe expects US online holiday sales to reach $275.1 billion between November 1 and December 31, 2026. - The PHP project ends support for PHP 8.2 on December 31, 2026. - On October 6, 2026, WordPress.org statistics showed 36% of WordPress sites on PHP versions that had already lost support and another 25% on PHP 8.2. - If those sites do not upgrade, 61% of WordPress sites will be running unsupported PHP on January 1, 2027.

The details: - PHP 8.2 received seven security releases between March 2025 and September 2026, which fixed 34 security issues. - PHP 7.4 lost support on November 28, 2022, and WordPress.org statistics showed it still running on 17% of WordPress sites. - WordPress guidance on changing PHP says the move “should not be a problem, but we can’t guarantee that it’s not.” - WordPress advises making a backup and testing themes and plugins before switching versions. - CodeGuard, available through SSL Dragon, provides a daily backup of site files and the database and restores it in one step. - If an upgrade breaks a site, the owner can switch PHP back and restore the backup. - SiteLock scans for malware daily and can remove infections automatically. - TrustedSite shows a certification only while weekly scans come back clean.

Between the lines: - The warning is less about PHP itself and more about timing. Stores are being asked to choose between a risky holiday-season change and a longer period on unsupported software. - The security and trust tools SSL Dragon highlights are positioned to lower the fear of upgrading, not replace the need to upgrade. - Backup and restore planning matters because plugin compatibility remains the main operational risk during a PHP move.

What’s next: - SSL Dragon advises store owners to check their current PHP version and ask their host whether PHP 8.2 will keep receiving patches after December 31. - The company also recommends testing the new PHP version and a restore on a staging copy before changing production. - The live switch should move to PHP 8.3 or later, follow a fresh backup and happen before December 31. - SSL Dragon says stores should avoid making the change during Cyber Week, November 26 to 30. - Roman Munteanu, SSL Dragon’s CEO and founder, said delaying the upgrade until after the holidays can leave stores on unsupported software for years.

The bottom line: - WordPress stores on PHP 8.2 have a narrow window to upgrade safely before year-end support ends and holiday traffic peaks.