How to Change PHP Version in cPanel and Other Hosts (October 2026)

Changing your PHP version isn't how PHP2Shell gets fixed: on 8.2 to 8.5, the fix arrives when your host installs a patched build of the branch you're already on, and re-selecting that branch does nothing. The version change matters if you're on 8.1 or older. The PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October, and said "PHP 8.1 and older no longer receive updates from the PHP project".

On shared hosting, the panel menu points your site at a PHP build the host installed and maintains. When the host patches that build, every site on it gets the fix at once. That's why SiteGround, Hostinger, GoDaddy, Bluehost and Vodien all told shared customers they didn't need to act.

Two catches. The number you see might not move: CloudLinux, which sits under a lot of cPanel shared hosting, says "our packages carry the fix as a backport, so their version numbers stay below PHP's". And on a VPS or cloud server, nobody patches PHP unless you or your developer do.

So change the version when:

• you're on 8.1, 8.0, 7.4 or older. The PHP project released nothing for those branches. cPanel, Plesk and CloudLinux backported this fix into their own builds, so your host may have covered you this time, but those branches won't get the next one, and CISA's advice on 21 October was to take systems on 8.1 or older offline until updated. Not everyone is that alarmed: Sansec, which watches online stores, said on 22 October that public exploits don't work against a default PHP install and that "you do not need to take your store offline".
• you're on 8.2. It's patched in 8.2.35, but 8.2 gets no security fixes after 31 December 2026.
• your host has told you to.

Before you change PHP version, take a backup, write down the version you're on now, and try the new version on a staging copy if your host offers one, because a plugin or theme that doesn't support the new PHP can take the site down. On WordPress, the breakage usually comes from an old plugin or page builder, not WordPress itself.

1. Back up files and database, and download a copy.
2. Note the current version exactly, so you know what to switch back to.
3. Update WordPress, the theme and plugins first, on the current PHP.
4. Switch a staging copy first. SiteGround, Hostinger and GoDaddy's Managed WordPress have staging built in.
5. Test the pages that earn you money (contact form, checkout, booking page) then switch the live site at a quiet hour.

The full process, including the "this plugin only runs on 7.4" trap and what to test on a WooCommerce shop, is in my guide to updating PHP in WordPress without breaking it. The rest of this post is where to click.

To change PHP version in cPanel, open MultiPHP Manager in the Software section, tick the checkbox next to your domain, choose a version from the PHP Version menu and click Apply. It changes only the domains you ticked, so you can move one site at a time.

1. Log in to cPanel and click MultiPHP Manager under Software.
2. Tick the checkbox next to the domain.
3. Choose a version from the PHP Version menu. Versions your host recommends carry a "Recommended" label.
4. Click Apply. If PHP-FPM is on, cPanel moves it to the new version too.

A domain set to inherit follows the server's default PHP, which cPanel's documentation says only the server administrator can set. On shared hosting that means "whatever the host picked", so I set a version on purpose. If the version you want isn't listed, it isn't installed for your account.

On your own VPS, the same tool sits in WHM under Software, and patching is your job. cPanel shipped the fix in EasyApache 4 on 21 October, moving ea-php83 from 8.3.35 to 8.3.36 (with 8.2, 8.4 and 8.5 likewise) and backporting it into its 7.4, 8.0 and 8.1 packages without changing their numbers. Your server only gets it when its packages update. If you don't know when that last happened, run the update now.

On hosts that run CloudLinux, cPanel also has Select PHP Version: open it under Software, choose a version from the PHP version menu, click Set as current, and check the extensions on the same page. CloudLinux calls it the PHP Selector, and Vodien and Exabytes both use it.

1. Log in to cPanel and click Select PHP Version under Software.
2. Choose the version from the PHP version menu and click Set as current.
3. Extensions are set per version, so check that anything your site needs, such as imagick or ionCube, is ticked for the new one.
4. For settings like memory_limit, click Switch to PHP options. Changes save automatically.

If Select PHP Version seems to do nothing, look at MultiPHP Manager. CloudLinux's documentation says the domain should stay on the system default there for the selector's choice to apply. The versions on this menu are CloudLinux's own builds, which got the PHP2Shell fix by 22 October under version numbers below PHP's.

In Plesk, go to Websites & Domains, click PHP on the domain's card, choose the version and the handler from the drop-downs, and click OK. The current version shows beside the PHP button, so note it first. If "PHP support" isn't ticked on that page, tick it.

Plesk's PHP settings guide is frank about breakage: "Different PHP versions are not 100% compatible," and "if your website is not displaying correctly, try switching to a different PHP version." Plesk ships its own PHP builds, and its change log for 21 October lists the four fixed releases plus the fix backported into its 8.1.34, 8.0.30 and 7.4.33 builds on Linux. On your own Plesk server, those install automatically only if third-party updates are switched on; otherwise go to Tools & Settings, then Updates.

To change PHP version in Hostinger, go to Websites, click Dashboard next to the site, choose PHP Configuration in the sidebar, select the version and click Update; Hostinger says it takes effect within a couple of minutes.

Two lines on Hostinger's help page matter more than the clicks. The version "applies to all websites on the hosting plan, except websites created with Hostinger AI Builder", so one change moves every WordPress site on the plan. And "downgrading to lower versions is not possible (except within the same login session if an issue occurs)". If the upgrade breaks something, switch back before you log out. Hostinger hides 8.1 and lower, starts new sites on 8.3 and offers 8.2 to 8.5.

In SiteGround, open Site Tools for the site, go to Devs, then PHP Manager, click the pencil icon next to the PHP version, choose Managed PHP or a version of your own, and click Confirm. Site Tools is the button next to the site on the Websites tab.

Managed PHP, on by default for new accounts, means SiteGround "will periodically update the default PHP version" for you. Pick a version yourself and, per SiteGround's help page, "your PHP version will not be automatically updated by us". That's about the branch. Security patches are separate: a SiteGround staff reply under its PHP2Shell post says the protection applied "regardless of whether your websites use Managed PHP or a manually selected version". To roll back, use the same pencil icon.

On GoDaddy Web Hosting, go to your product page, select Manage next to the hosting account, open the Settings tab, select Change next to PHP Version under Server Settings, pick a version, then Continue and Save Changes. That's the path on GoDaddy's help page, which adds that you can roll back "by repeating these steps to select your previous PHP version".

On Managed Hosting for WordPress, it's Manage All, then Settings from the site's menu, then Change next to PHP version under Production Site. GoDaddy warns that "upgrading the PHP version can cause issues with your site" and suggests trying it on staging first.

GoDaddy's software versions page lists 8.3 as the Web Hosting default, and 8.1 or older needs its paid PHP Extended Support. Paying to stay on an old branch doesn't get you a release from the PHP project.

On Bluehost shared hosting, go to Websites in the Bluehost Portal, click Manage Site, open the Advanced tab, click Change Version in the PHP Version tile, pick a version and click Apply. That's from Bluehost's PHP help page, updated in June 2026.

The same page gives a cPanel route (Hosting, My Plans, cPanel, then MultiPHP Manager), and Agency hosting puts PHP Version under the Settings tab of Manage Site. Bluehost says 8.5 is the newest PHP on its shared servers and that versions below 8.2 "have been marked as deprecated". To roll back, pick your old version in the same menu.

Vodien and Exabytes both use cPanel on their shared plans, so you change PHP version with Select PHP Version or MultiPHP Manager; Vodien's newer plans also have a PHP Version setting in its own Linux Control Panel, and Exabytes' WordPress Hosting runs on Plesk.

• Vodien, Linux Control Panel: find your site and click SETTINGS, then CHANGE next to PHP Version in the Update Status section, select a version and click APPLY. On classic plans, Vodien says PHP can only be changed in cPanel, which you reach from your Vodien account through the product's Control Panel tab and Quick Links.
• Exabytes, cPanel shared hosting: per Exabytes' guide, click Select PHP Version under Software, choose a version and click Set as current.
• Exabytes, WordPress Hosting: from the client area (My Services, My Product & Services, Manage my WordPress), click PHP Settings, select the version and click OK. Exabytes notes the change applies to every WordPress install on the subscription.

Neither host's help pages cover rolling back. Both panels work the same way in reverse: pick the old version and apply it.

By 23 October 2026, SiteGround, Hostinger, GoDaddy, Bluehost and Vodien had all said their shared hosting was patched or being patched, cPanel and Plesk had shipped fixed PHP packages, and Exabytes had posted only a warning before the release. Here's what each one published.

Notice the pattern. Every host fixed the branch customers were already on, which is why none told shared customers to change version. GoDaddy and Hostinger both say to judge by the PHP build date (21 October or later), not the version number, because backported builds keep the old number. If your host isn't here, ask it: the three questions in my PHP version guide work for any host.

To switch back after a PHP change breaks your site, open the same panel and select the version you were on before, then find out what broke before you try again. On most hosts it takes effect within a minute or two. This is the order I work in:

1. Switch back first so customers see a working site. On Hostinger, do it before you log out.
2. Check your email. WordPress usually emails the admin address when a plugin causes a fatal error, naming the plugin and giving a recovery-mode link.
3. Read the error log. cPanel's Errors page under Metrics shows recent errors, and many hosts also write an error_log file in the site's folder. The plugin or theme folder named there is usually the culprit.
4. Clear every cache: the caching plugin, the host's cache and Cloudflare can keep serving broken pages after you switch back.
5. Restore the backup if switching back didn't fix it. Putting PHP back won't undo plugin updates you ran along the way.

Treat the rollback as a stopgap. If you rolled back to 8.1 or older, fix or replace the plugin on a staging copy and move up within days. And if the log shows files you didn't upload or admin users nobody created, that's a different problem: read what to do if your WordPress site is hacked.

For most WordPress sites in October 2026, choose PHP 8.3 or 8.4: WordPress recommends "PHP version 8.3 or greater", and 8.3 gets security fixes until 31 December 2027, 8.4 until 31 December 2028. Pick 8.5 only if your theme and plugins support it, and skip 8.2, which ends on 31 December 2026.

The dates are from PHP's supported versions page and the recommendation from WordPress.org's requirements. My guide to PHP end of life has every branch's dates and what happens after them.

A PHP version is missing from your panel because your host hasn't installed it on your server or your plan doesn't include it; on shared hosting you can't add it yourself, so ask the host when it's coming. Bluehost offers 8.5 on shared servers, for example, while GoDaddy's list stops at 8.4.

If your host offers nothing newer than 8.2, or can't tell you whether its PHP is patched, that tells you how the server is looked after. My roundup of the best web hosting in Singapore is a starting point if it's time to move.

You can change the PHP version for one website in cPanel's MultiPHP Manager, which sets PHP per domain and subdomain, but not on every host: Hostinger and Exabytes' WordPress Hosting apply one PHP version to every site on the plan. Check which tool you're in, so you don't move five sites when you meant to move one.

CloudLinux's Select PHP Version can also cover more than one domain on an account. If other sites share the plan, test them after the switch as well.