Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

The right PHP host is the one that matches your application’s exact PHP branch, extensions, database, web server and deployment workflow—not the one with the largest “unlimited” storage claim. Start by confirming compatibility, then compare resource limits, hosting model, security and update practices, backups and restores, staging, support, migration options and the full renewal cost. For a new WordPress production site in 2026, favor a host that supports PHP 8.4 or newer, HTTPS, MariaDB 10.11 or newer or MySQL 8.0 or newer, and Apache or Nginx, while still providing a safe way to test upgrades against your plugins and themes.

What should you check first when choosing PHP hosting?

Make a technical requirements sheet before looking at plans. “Supports PHP” is too vague: a provider can offer PHP while missing the branch, extension, database version or process controls your application needs. Record the requirements for the production application, not just a one-click installer.

  • PHP branch: note the exact version your code supports and the newest version you want to test. Ask whether PHP can be selected per site, whether command-line PHP matches the web version, and whether older branches receive security backports.
  • Extensions: list every required extension, such as database drivers, image processing, internationalization, archive or caching modules. Confirm that you can enable them without a support ticket when possible.
  • Database: specify the engine, minimum version, connection limits, maximum database size and whether remote connections are needed.
  • Web server and rewrites: verify Apache or Nginx support, URL rewrite rules, HTTP/2 or HTTP/3 if your application requires them, and access to the relevant configuration.
  • HTTPS: confirm certificate issuance, renewal and enforcement at every hostname, including staging domains.
  • Operations: identify requirements for SSH, Composer, Git, cron, queue workers, scheduled tasks, background processes and log access.

Use the application’s documented requirements as the authority. For WordPress, WordPress.org currently recommends PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, HTTPS, and Apache or Nginx. Its published request also calls for mod_rewrite when Apache is used. A plugin or theme can impose stricter requirements, so check the complete stack rather than relying on the core requirement alone.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Which PHP version should your host support in 2026?

Choose a provider with a current PHP release and a documented upgrade path. WordPress hosting guidance recommends PHP 8.4 or later for production. PHP 8.3 moved to security-only support on December 31, 2025, and PHP 8.2 reaches end of life on December 31, 2026. Those dates do not make an older site stop working immediately, but they increase the risk that new vulnerabilities, libraries or application releases will leave it behind.

PHP branch What the current guidance means How to use that information
PHP 8.4 or later Recommended for production WordPress hosting guidance. Prefer it for a new build, subject to testing your themes, plugins and custom code.
PHP 8.3 Security-only support began December 31, 2025. Acceptable only when your application has a tested reason to remain there and the provider has a clear upgrade plan.
PHP 8.2 End of life is scheduled for December 31, 2026. Treat it as a transition version; plan migration or an upgrade before that date.
Older branches Support status and backport policy vary by provider. Ask exactly what security maintenance exists and for how long; do not assume “available” means secure.

Version flexibility matters because production and development often need different timing. A good control panel lets you run a staging copy on the candidate version, test the application, and then change the live site with a rollback path. Confirm that the host’s web PHP, CLI PHP used by Composer, and scheduled-task PHP can be aligned; mismatches can make code pass in one context and fail in another.

Upgrading PHP can improve efficiency and security, but compatibility testing remains necessary. Check your theme, plugins, framework packages and custom extensions in staging before changing production. A provider that advertises many old versions without explaining patching or isolation is not automatically more flexible; it may simply leave you carrying more security risk.

How much PHP memory and server capacity do you need?

Look past disk space and monthly transfer. PHP memory, CPU allocation, concurrent workers and entry-process limits determine whether requests complete during traffic spikes. A plan can be labeled “unlimited” while enforcing strict process, inode, database or CPU limits.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Workload PHP memory starting point Capacity questions to ask
Small brochure site or light blog 128M minimum in the WordPress hosting guidance What is the CPU share, process limit and database size ceiling?
Typical WordPress production site 256M recommended default How many PHP workers or entry processes are included, and are limits documented?
WooCommerce, page builders, multilingual plugins or import/export tools 512M or more for resource-intensive sites Can memory and workers be increased without moving immediately to a new platform?

Memory is not the same as total server RAM. PHP’s memory_limit controls what one PHP request may allocate; worker count controls how many requests can run at once; CPU determines how quickly they finish. Ask for all three. Also check storage type, inode limits, database size, bandwidth policy, backup storage quotas and overage behavior. A site with many small files can hit an inode ceiling long before it fills its advertised disk allocation.

Estimate headroom from the busiest operation, not the homepage. Product imports, image processing, search indexing, backups and checkout requests can require substantially more memory and concurrent workers than ordinary page views. If the provider will not publish numerical limits, ask support for the limit values in writing and keep the answer with your account records.

Should you choose shared hosting, managed WordPress, a VPS or cloud hosting?

Choose the simplest model that supplies the control and predictable capacity your application needs. The models overlap, but their administrative responsibilities differ.

Shared hosting

Shared hosting suits a simple, lower-traffic site with standard PHP and database needs. The provider manages the underlying server, so the entry cost and maintenance burden are usually lower. In exchange, CPU, memory, workers and noisy-neighbor isolation may be shared. Verify process limits, account isolation, available PHP extensions, SSH and cron before committing.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Managed WordPress

Managed WordPress is appropriate when WordPress is the application and you want the host to handle more routine administration. Look for tested PHP upgrades, automated updates with rollback, staging, backups and WordPress-aware support. Confirm that the plan still permits the plugins, themes, cron jobs, SSH or Composer workflow your site uses; “managed” should not mean that essential deployment access is removed.

VPS

A VPS is a better fit when you need SSH, Composer, custom extensions, cron, queue or worker processes, or more predictable resource allocation. You gain control over the operating system and services, but you also take on patching, hardening, monitoring and recovery unless a management layer is included. Confirm who is responsible for the web server, PHP-FPM, database, firewall and backups.

Cloud hosting

Cloud hosting can provide flexible scaling and multiple deployment patterns for applications with variable demand or several services. Compare the actual CPU, memory, worker and storage allocations rather than assuming that a cloud label guarantees performance. Ask how scaling is triggered, how it is billed, whether databases and workers scale independently, and how you export the application if you leave.

Model Best fit Main trade-off
Shared Simple, lower-traffic sites with conventional requirements Shared resources and less control over server configuration
Managed WordPress WordPress owners who want application-focused operations More platform constraints; verify plugin, deployment and access compatibility
VPS Custom stacks, background jobs and predictable allocation You may be responsible for operating-system and service administration
Cloud Variable workloads or multi-service deployments More complex architecture and usage-based cost; verify scaling and exit procedures

What security and PHP update practices should a host provide?

Require HTTPS, maintained PHP and database versions, account isolation and a documented patching process. Ask how the provider separates accounts from the server’s default shared username, because isolation limits the damage from a compromised site. Also ask whether PHP-FPM pools, filesystem permissions and database credentials are separated per account or site.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • HTTPS lifecycle: certificates should be issued, renewed and deployed automatically, with a clear method for forcing HTTPS and protecting staging credentials.
  • Patch ownership: establish whether the provider patches the operating system, web server, PHP runtime and database, and how customers are notified of disruptive changes.
  • Vulnerability response: ask for the escalation route when a PHP, plugin or server vulnerability is disclosed.
  • Least privilege: verify separate users, restricted SSH keys, database permissions and the ability to revoke access without closing the account.
  • Malware handling: understand whether detection is included, what happens when a site is isolated, and whether clean restoration points are available.

Security tooling is not a substitute for supported software. Keep the application, plugins and Composer packages current, and use staging to test updates. A host that offers an obsolete PHP branch without a stated security policy may create a false sense of compatibility.

How do backups, staging and restores affect the decision?

Choose a host that lets you create a staging copy, restore a known point quickly and verify that the restored site actually works. A backup that exists but cannot be restored within your recovery window is not a complete recovery plan.

Backups

Ask what is backed up: files, databases, uploaded media, configuration, cron definitions and SSL-related data. Confirm frequency, retention, storage location, encryption, account-level isolation and whether backups remain available after a cancellation. Off-site copies reduce the risk that a server incident destroys production and its backup together.

Restore controls

Check whether you can restore the whole account, a single site, only a database or selected files. Identify who can initiate a restore, how long it normally takes, and whether the operation overwrites current data. A one-click restore is valuable only if the control panel clearly shows the restore point and warns about what will be replaced.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Staging

Staging should be isolated from search engines and real customer traffic, yet close enough to production to expose PHP, database and plugin incompatibilities. Ask whether staging uses the same PHP branch, extensions, workers and database engine as live, and whether you can push changes in either direction without overwriting new production data.

Automated updates and rollback

Automatic updates can reduce exposure, but they should include a pre-update backup, a visible change log and a rollback mechanism. Confirm whether rollback covers both files and the database; restoring only files may leave schema changes or content updates inconsistent.

Does the host support your deployment workflow?

Operational access often matters more than a plan’s storage quota. Confirm each tool before purchase and distinguish web-panel access from shell access.

  • SSH: check whether it is included, key-based, restricted to a site user and available in production and staging.
  • Composer: verify the Composer version, memory available to dependency installation and whether command-line PHP uses the same extensions as web PHP.
  • Git deployment: ask whether the host can pull from your repository, deploy a specific branch or commit, run build steps and atomically switch releases.
  • Cron: confirm minimum interval, command syntax, execution timeouts, environment variables and the PHP binary used.
  • Queues and workers: establish whether long-running processes are allowed, how they are supervised, and whether worker counts are capped.
  • Logs and monitoring: require access to PHP, web-server and database error logs, plus monitoring that alerts on failures rather than only reporting uptime.

For a basic site, these capabilities may be unnecessary. For a framework application, an e-commerce site or a team deploying frequently, their absence can force manual uploads and make recovery slower. Include the deployment process in your compatibility test before selecting a plan.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How should you evaluate support and migration assistance?

Support quality is measured by whether the team can diagnose your application stack, not merely reset a control-panel password. Check support hours, response targets, escalation levels and the channels available during an outage. Ask whether agents can review PHP error logs, database errors, resource-limit events and failed cron jobs.

For migration, request a written scope: files, databases, email if applicable, DNS or certificate changes, staging validation, redirects and rollback. Find out whether migration is free, how many sites are included, whether there is a deadline, and what happens if the source host uses a different PHP or database version. Keep an export of your files, database and DNS records so you retain an exit path even when migration assistance is offered.

Test support before buying with precise questions about your PHP branch, extensions, memory limit, Composer and cron. Vague answers at the sales stage usually become slower troubleshooting after launch.

How do you compare the real recurring cost?

Calculate total cost of ownership for the period you expect to stay, using the post-introduction renewal price rather than the sign-up promotion. Put every recurring and one-time charge in one worksheet.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Cost item What to verify
Base hosting renewal Renewal price, billing term, tax treatment and any required longer commitment
Resource upgrades Additional PHP memory, workers, CPU, storage, database capacity or bandwidth
Backups Retention, off-site copies, restore fees and storage overages
Staging Whether staging is included or billed per site, environment or month
Domains and HTTPS Domain renewal, transfer fees, certificate charges and wildcard or additional-hostname costs
Email and databases Mailbox, database count, size, connection and delivery limits
Migration and exit Assisted migration, export restrictions, cancellation timing and data retrieval
Overages CPU, process, traffic, storage, inode and support charges when limits are exceeded

Compare equivalent capacity, not headline discounts. A low introductory rate can become expensive if staging, backups and PHP memory are add-ons. Conversely, a higher base price may be cheaper when it includes the controls your workflow requires. Because prices, availability and terms change, verify them directly on the provider’s current plan and contract pages before purchase.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What questions should you send a prospective host?

Send a short, specific request and ask for numerical answers. For WordPress, WordPress.org supplies this opening wording: “I’m interested in running the open source WordPress https://wordpress.org/ web software, and I was wondering if my account supported the following”. Continue with your own version, extensions and workflow.

  1. Which PHP versions are currently available, and can I select PHP per site for both web and CLI execution?
  2. Are PHP 8.4, the extensions my application needs, and the required database versions available on the plan?
  3. What are the PHP memory limit, CPU allocation, worker or entry-process limit, storage type, inode limit, database limit and bandwidth policy?
  4. Are SSH, Composer, Git deployment, cron jobs, logs and long-running queue workers supported, and what restrictions apply?
  5. How are accounts isolated, who patches PHP and the database, and how are security incidents communicated?
  6. How often are backups made, where are they stored, how long are they retained, and can I restore a site or database myself?
  7. Is staging included, does it mirror production PHP and extensions, and is there an automated rollback after updates?
  8. What support hours and escalation targets apply to application errors, resource exhaustion and outages?
  9. What are the renewal price, add-on charges, overage rates, migration terms and data-export process?

Save the answers and compare them beside your requirements sheet. If a sales representative cannot answer a technical question, ask for a written response from the hosting operations team before paying.

What are the most common PHP hosting mistakes?

Choosing by storage or bandwidth alone

Large quotas do not reveal worker limits, CPU contention, PHP memory or database performance. Evaluate the limits that affect request execution and administration.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keeping an obsolete PHP version for convenience

Compatibility work is real, but postponing upgrades indefinitely leaves the site exposed to unsupported software. Use staging, identify the incompatible extension or plugin, and set a date for remediation.

Assuming “managed” includes every tool

Some managed plans restrict SSH, Composer, cron or custom extensions. Confirm your deployment path before migrating; otherwise the platform may require a redesign of your release process.

Counting a backup without testing restoration

Check that files, databases and configuration can be restored together and that the restored site loads, authenticates and completes a representative transaction.

Ignoring renewal and exit costs

Promotional pricing, paid staging, backup storage, migration fees and overages can change the economics. Record renewal terms and practice exporting the site before you need to leave.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Skipping a capacity upgrade path

A site can outgrow shared hosting because of workers or CPU even when storage remains plentiful. Ask whether you can increase resources in place or move to a VPS or cloud environment without changing the application’s domain and deployment process.

What is a practical selection process?

Use this sequence to reduce the chance of an expensive mismatch.

  1. Inventory the application. Record PHP, extensions, database, web-server features, memory needs, scheduled jobs, queues, deployment tools and traffic patterns.
  2. Set a supported-version target. Prefer PHP 8.4 or later for a new production WordPress site, while documenting any tested compatibility exception.
  3. Eliminate incompatible plans. Reject hosts that cannot meet the exact PHP branch, database, HTTPS, rewrite or extension requirements.
  4. Compare capacity. Put memory, CPU, workers, storage, inodes, database limits and bandwidth policy in a side-by-side table.
  5. Validate operations. Confirm staging, backups, restores, rollback, SSH, Composer, Git, cron, queues, logs and monitoring.
  6. Audit security and support. Obtain the isolation, patching, incident-response, support and migration answers in writing.
  7. Calculate total cost. Include renewal, add-ons, overages, domain and certificate services, migration and exit charges.
  8. Run a pre-launch test. Deploy a copy, execute representative application tasks, test a restore and verify the PHP version used by web requests, CLI commands and cron.
  9. Document the decision. Keep the requirements, support answers, credentials policy, backup schedule and rollback procedure where the team can access them.

The best provider is therefore workload-dependent: shared hosting can be correct for a modest site, managed WordPress for a WordPress-focused operation, and a VPS or cloud environment for custom processes and predictable allocation. The deciding evidence is the documented technical fit and recovery path, not the marketing label.

Frequently Asked Questions

Can I run different PHP versions for different websites on one account?

Only if the host supports per-site version selection and keeps the web, CLI and cron runtimes consistent. Ask whether changing one site’s PHP branch affects other sites, shared extensions or the account-wide Composer environment.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What should I do if a required PHP extension is unavailable?

Ask whether the extension can be enabled, whether an equivalent supported extension exists, and whether the restriction applies to web PHP, CLI PHP or both. If the answer is no, treat the plan as incompatible rather than relying on a workaround that the provider may remove.

How can I tell whether a host’s PHP limit is being reached?

Look for PHP error logs, resource-limit events, slow-request data and worker or entry-process graphs. A reliable host should identify which limit was exceeded so you can tune the application or choose a larger plan instead of guessing.

Is PHP 8.3 unsafe immediately because it is security-only?

No. Security-only support means the maintenance phase changed on December 31, 2025, not that every 8.3 site stopped functioning that day. It does mean you should test an upgrade path and avoid starting a new production deployment on an aging branch without a documented reason.

What should be in a migration rollback plan?

Keep a verified export of files, the database and DNS records, record the previous PHP and database versions, and define how to restore the old site if validation fails. Set a clear DNS and content-freeze procedure so new orders or edits are not lost during the switch.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.