Every year another PHP branch stops receiving security fixes, and every year we meet stores and business systems still running on it. Sometimes the reason is a single old plugin. Sometimes nobody knew. Here is how we think about the upgrade-or-migrate decision with clients.
What “end of life” means in practice
An end-of-life PHP version still runs. It simply no longer gets patches. Vulnerabilities discovered after that date stay open forever on your server, and attackers know exactly which ones. Hosting providers eventually remove old versions, which is when the emergency starts. Modern versions are also significantly faster: moving from PHP 7.x to 8.4 alone often makes a store noticeably quicker before anyone touches the code.
Upgrade when
- The platform and the plugins you depend on support the new version (or have maintained alternatives).
- The code base is yours and reasonably structured; deprecations can be fixed in days, not months.
- The business logic still fits how you work.
An upgrade project looks like this: staging copy on the new PHP, run the site and its jobs, fix what breaks, update dependencies, test the critical flows (checkout, imports, exports, payments), switch. For most stores it is one to three weeks including testing.
Migrate when
- The platform version itself is end-of-life and the upgrade path is effectively a rebuild (Magento 1, old OpenCart 2.x, PrestaShop 1.6 sites live here).
- The site depends on abandoned modules that nobody can replace.
- Every change takes longer than it should because of accumulated workarounds.
Migration is a bigger project, but done properly it is invisible to customers: the same URLs, the same accounts and order history, the same or better rankings. We did exactly this for Mnogoknig, moving a bookstore to a new Laravel and Vue.js platform without losing a single key URL.
Either way: do not wait for the deadline
Planned upgrades are cheap. Emergency upgrades on a hosting provider’s deadline, during the season, with a store that is already slow and possibly already compromised, are not. If you are not sure which PHP and platform versions you run, that is the first thing to find out. We can check for you and give you a plan with dates and a price.
