Got a PHP email from your web host? How to read it
Host emails about PHP come in three kinds: we fixed it, please move up, or we're switching you. What each one asks of you, and how to tell if it's real.
By Jeensuk Yang
PHPFree · Web security · How to read it
?Who this is for
- Your web host sent an email about "PHP version" or "end of life," and it's still sitting unread
- You can't tell what the email actually wants you to do
- You're not sure whether it's really from your host or a scam
!What you'll learn
- The three kinds of PHP emails hosts send, and what each one asks of you
- What the unfamiliar words in them mean
- How to check an email is real without clicking its links
Building notices all look alike. What they ask of you doesn't.
Picture the notices your building manager tapes up in the lobby. "Elevator maintenance Tuesday" just means take the stairs that morning. "Plumbing replacement, we need access to your unit" means picking a date and clearing out the cabinets. Same kind of paper, very different weight. Emails from your web host work the same way. Lots of unfamiliar words make you not want to open them, and leaving them unopened only makes you more uneasy. This article puts how to read them on one page. Most of the time, once you open one, there's nothing to do, or very little.
What is your host's PHP email actually saying?
There are three broad kinds: "We fixed it" (nothing to do), "Please move up at some point" (pick a date), and "We're switching you on this date" (get ready now).
- "We fixed it": during PHP2Shell, Kinsta told customers, "We deployed security updates for PHP 7.4 through PHP 8.5," and "You don't need to change your PHP version, install a separate patch, or take your website offline."1
- "Please move up": DreamHost "recommends at least PHP 8.4 since PHP 8.1 has already been deprecated by php.net."2 Bluehost lists PHP 7.3, 7.4, 8.0 and 8.1 as deprecated and supports 8.2 and above.3
- "We're switching you": WP Engine automatically upgrades every site when a PHP version reaches end of life, and "automatic PHP upgrades cannot be deferred." It emails your technical contact several times beforehand.4 Kinsta does the same: "When a PHP version reaches its end of life, we automatically upgrade your site to the latest supported version."5
Emails that arrive the same week can carry very different weight depending on the host.
Jeensuk's takeNot opening the email is the biggest loss. Often it ends with "nothing to do," and just knowing that takes a weight off.
What do the unfamiliar words in the email mean?
Know four terms and you can read most of these emails: end of life, deprecated, automatic upgrade and version number.
| Term | What it means | So what do you do? |
|---|---|---|
| End of life (EOL) | That version gets no more security fixes. PHP's own site says if you're on one, "you are strongly urged to upgrade to a current version."6 | Pick a date to move. PHP 8.2's security support ends December 31, 2026.7 |
| Deprecated | The host still runs it but no longer recommends it, as Bluehost does with 7.3 through 8.1. | Treat it as a heads-up that end of life is coming. |
| Automatic upgrade | The host will move your site to a newer version on its own schedule. At WP Engine, it can't be put off. | Test your site on the newer version before their date. |
| Version number | The first two numbers (8.2, 8.3) are the branch that gets supported or retired; the last number is a patch release. | Check the branch against PHP's support dates. |
Jeensuk's takeUnfamiliar words aren't walls; they're name plates. Once you know the name, you know whose door it is.
How do you tell whether it needs action now?
Hold the email's wording up against the table below. "No action needed" means nothing to do; "we recommend" means pick a date; "on [date] we will" or "you must" means move now.
| If the email says something like | Weight | What to do |
|---|---|---|
| "We've applied the fix," "No action is required" | Nothing to do | Save the email. If you have a developer, forward it with one line. |
| "We recommend upgrading," "This version is deprecated" | Pick a date | Choose a day this year to move up. |
| "On [date] we will upgrade," "Please switch by [date]" | Get ready now | Back up and test before that date, then check your pages, contact form and uploads afterward. |
Jeensuk's take"We recommend" doesn't mean "right now." It means "don't forget." Writing one date on your calendar is enough.
How do you know the email is really from your host?
Don't click the links in the email. Open your host's website yourself and see whether the same notice is there. Be extra careful with any email that rushes you to pay or log in.
The FTC says phishing emails often "claim there's a problem with your account or your payment information" or "want you to click on a link to make a payment," and advises contacting the company using "a phone number or website you know is real."9 CISA lists warning signs such as "urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately," and "incorrect email addresses or links."10
- Open the door yourself: go to your host's site from a bookmark or by typing the address, and look for the same notice in your dashboard or announcements.
- Check the address: on any login page, make sure the address bar shows your host's real domain.
- Distrust the rush: "today only," "your account will be suspended" are favorite phishing tactics.
- When in doubt, ask: contact your host through the support page on its real site. If it's a fake, forward it to reportphishing@apwg.org and report it at ReportFraud.ftc.gov.9
Look up another way to contact the company or person directly. — CISA, "Recognize and Report Phishing"
Jeensuk's takeWhen security news is loud, fake emails get louder too. The more anxious you feel, the more you should skip the link and walk in through the front door.
Your host says you have to switch. What comes first?
First check that you have a backup, and whether your host lets you test on a staging copy. Then switch, and afterward check your pages and contact form.
If your host will upgrade you automatically, the date is already set; what's left is deciding who tests the site before that day. In my experience, the trouble almost never comes from PHP itself but from an old plugin or theme, so that's what to test. Our host-by-host guide and our upgrade timetable are coming soon in English.
Jeensuk's takeWhen the email sets the "by when," all you have to decide is "who." Do it yourself, or hand it to your developer. Just that one choice.
Frequently asked questions about PHP emails from your web host
If the email says "no action required," can I really do nothing?
For that particular fix, yes. But if the same email also recommends moving to a newer version, pick a date this year to do it.
Does "end of life" mean my site gets hacked right away?
No. It means no more security fixes from now on. That's why you set a date to move before the next problem comes along.
What if I can't tell whether the email is real?
Don't click any links in it. Open your host's website yourself and look for the notice, or ask through its support page. That's the surest way.
SOURCES
- Kinsta, "PHP2Shell: How Kinsta protected WordPress sites" (Oct 23, 2026) kinsta.com
- DreamHost, "Upgrading your WordPress site to the latest PHP version" (updated Jul 16, 2026) help.dreamhost.com
- Bluehost, "Changing PHP and WordPress Version" (updated Sep 3, 2026) bluehost.com
- WP Engine, "PHP Upgrade Guide" (updated Jul 12, 2026) wpengine.com
- Kinsta Docs, "Restart and Update PHP" (updated May 28, 2026) kinsta.com
- PHP Group, "Unsupported Branches" php.net
- PHP Group, "Supported Versions" php.net
- WordPress.org, "Requirements" (updated May 7, 2026) wordpress.org
- FTC Consumer Advice, "How To Recognize and Avoid Phishing Scams" (Sep 2022) consumer.ftc.gov
- CISA, "Recognize and Report Phishing" (archived page) cisa.gov
Once you've read the email, the next steps continue here. More English editions are on the way.
- Is your business website affected? A one-minute PHP check (coming soon)
- Got a PHP email from your web host? How to read it (this article)
- Where to check and change your PHP version, host by host (coming soon)
- PHP vulnerability fix guide: from checking to moving off PHP (coming soon)
To understand what went wrong, start with risk series part 1, "What is PHP2Shell?" More articles on the ATATAKAI Digital blog.
Hard to tell from the email alone?
Enter your site address and we'll tell you right away whether it runs on PHP and where your host stands. If you're not affected, we'll say so plainly: "No need to move right now."
Run the free 30-second checkWant to talk it through after you see the result? Contact ATATAKAI Digital
Updated Oct 26, 2026
