How Much Does a PHP Update Cost in Singapore? (October 2026)

A PHP update in Singapore costs SGD 0 if your host has already patched it or you switch the version yourself, a few hours to a few days of developer time if plugins break, and the price of a new site if the old one can't run a supported PHP at all. Here are the four tiers side by side.

I couldn't find a Singapore web company that publishes a price for a PHP update when I looked on 24 October 2026. Everyone quotes after seeing the site, me included, so the rest of this post talks in hours you can hold any quote up against.

Yes. On shared hosting, the PHP security update is the host's job and comes with the plan, and five of the big hosts said by 22 October 2026 that their shared servers were patched or being patched. You don't pay for it and you don't need to do anything.

The "PHP 8.3" in your hosting panel is a branch. The fix lives in one release on each branch (8.5.12, 8.4.27, 8.3.36 and 8.2.35, per PHP's advisory), and only the host can put it on the server. When it does, every site on that server is fixed at once. What the hosts said:

• SiteGround: "There's nothing you need to do."
• Hostinger: "PHP's fix is now installed on all Hostinger hosting servers except VPS."
• GoDaddy patched its shared plans by 22 October, and warned that "your PHP version number may not change after this update".
• Bluehost: "If you are on a patched version of PHP, no action is needed."
• Vodien: "PHP security patching has been completed across our shared Linux hosting environment."
• Exabytes had posted only a pre-release notice by 23 October, so ask them.

Two exceptions cost money. A VPS or cloud server is patched only when someone logs in and does it, and their time is billable. And a site on PHP 8.1 or older may have a host backport this time, but the branch gets nothing from the PHP project next time.

So get your version and patch date from the host in writing before you pay anyone. My guide on how to check your PHP version explains why a patched build can still show an old number.

You can switch your site to a newer PHP version yourself for SGD 0 in about ten minutes if you can log in to your hosting panel; the catch is that an old plugin or theme may stop working and take a page, or the whole site, down with it.

The switch is a dropdown: MultiPHP Manager or Select PHP Version in cPanel, a version menu everywhere else. My guide to changing PHP version in cPanel and other hosts has the click paths. What "free" leaves out is the backup, the test copy and the testing. Read the small print too: Hostinger says "downgrading to lower versions is not possible (except within the same login session if an issue occurs)", so check the site before you log out.

Do it yourself if your plugins are already current, your host offers one-click staging, the site takes no payments, and you have an afternoon to test. Hand it over if it's a shop, runs on a page builder nobody has updated in years, or nobody knows the hosting login. The full process is in my guide to updating PHP in WordPress without breaking it.

When a site breaks on newer PHP, the PHP update cost is developer time to update, replace or repair whatever failed, usually a few hours to a couple of days for a small WordPress site; I quote it as a fixed price from SGD 850, sized at SGD 110 to 150 an hour.

Sites break because code written for PHP 7 calls things PHP 8 took away. PHP 8.0 removed functions such as create_function() and each(), per PHP's migration notes, so a plugin that uses them stops dead and the page goes white. The usual suspects are abandoned plugins, premium themes whose licence lapsed (so the fixed version never arrived), and old page builders.

Where the hours go on a careful job:

1. A full backup, kept off the server, and a staging copy to test on.
2. WordPress, the theme and plugins updated on the old PHP, then the copy switched to 8.3 or 8.4 and every failure fixed or replaced.
3. Testing every form, the logins and, on a shop, a test order through each payment method.
4. The live site switched at a quiet hour, with the error log watched.
5. A look for signs of a break-in, since Amazon logged an attack attempt on 17 October, four days before the fix (Tenable collects the reports).

Roughly, from my own work: a brochure site with current plugins and one-click staging is an afternoon. A long plugin list with lapsed licences is a day or two, because every failed test means fixing a plugin before the next try. A shop adds payment testing on top.

With me, the known work gets a fixed price in writing and anything open-ended gets a cap you agree first, through my website maintenance service. If you only want someone to make the switch and click through it with you, that's ad hoc time at SGD 150 an hour, in 30-minute blocks.

A rebuild is cheaper than a PHP update when the site is pinned to PHP 7.4 or older by a page builder or theme that's been abandoned, because the repair means redoing most of the pages anyway, and that money buys more as a new site.

About 16% of the WordPress sites that report to WordPress.org still ran PHP 7.4 in October 2026, nearly four years after PHP stopped supporting it. Usually someone tried PHP 8 years ago, the site broke, they switched back "for now", and it never moved. Signs the repair will cost more than it's worth:

• The page builder the whole site is made of hasn't been updated in years.
• The company that sold the theme has gone.
• More than half the plugins need replacing, not updating.
• Nobody has edited the site in years anyway.

Then I quote the fix and a rebuild side by side. Starter is from SGD 2,535 for up to 10 pages in 2 to 3 weeks. The One Week Website is SGD 3,545 for up to 20 pages in seven days, without a CMS you edit yourself. Growth, from SGD 7,585, adds that CMS. A brochure site I'd usually build static, so no PHP runs on the server and there's no PHP update to buy again. That's how MET Interior's 176-page site moved from WordPress to Astro in August 2026. My redesign vs rebuild guide covers the decision.

Six things move a PHP update quote: how far the version has to jump, how many plugins the site runs, whether it's built on a page builder, whether it's a WooCommerce shop, whether anyone has the logins, and whether the host gives you a staging copy. If a quote is high, it should be because of something in this table.

A lapsed premium licence is yours, paid to the plugin's maker, so it belongs on its own line.

A fair PHP update quote names the version you're on and the one you'll end on, promises a backup and a test copy, lists the plugins to update or replace, and separates a fixed price for the known work from a capped amount for the unknowns. Look for these lines:

• Your current PHP version and the target, which should be 8.3 or 8.4. PHP's support dates run to 31 December 2027 for 8.3 and 31 December 2028 for 8.4.
• A backup before anything changes, and testing on a staging copy.
• The plugins and theme by name, marked "update" or "replace".
• What gets tested: forms, logins, checkout, bookings.
• A fixed price for the known work and a cap for the rest.
• Whether licence renewals are extra, and who fixes anything that breaks a week later.

Most honest quotes fit on one page. If yours doesn't mention a backup, ask about that first.

The red flags in a PHP update quote are charging for a patch your host already installed, moving you to PHP 8.2, selling a security plugin as the fix, open-ended hours with no cap, and any condition that moves your hosting or domain into the provider's name. In more detail:

• Billing for a patch the host already did. If the host has installed it, there's nothing to buy for PHP2Shell itself.
• A move to 8.2. Its security fixes end on 31 December 2026, so you'd pay for the same job again next year.
• A security plugin as the cure. PHP says the confirmed attack can trigger "before any application code runs", and Wordfence or any WordPress plugin is application code.
• Hourly with no ceiling on a site nobody has opened in years.
• Your hosting, domain or licences moved into their name, or a monthly contract made a condition of the fix.
• Panic selling. Singapore's Cyber Security Agency did tell organisations to update immediately, but a fair provider still gives you a written price and time to check with your host. And never run a "checker" someone forwards on WhatsApp: a fake scanner for last year's React2Shell bug carried malware.

Before you pay for a PHP update, ask whether your host has already patched it, which version you'll end on, how the site is backed up and tested, what's fixed and what's capped, and whether your accounts stay in your name. Copy these into your email or WhatsApp:

1. Has my host already installed the fix? What are the version and build date?
2. Which PHP version will I be on when you finish?
3. Will you back up first and test on a copy before touching the live site?
4. Which plugins will you update, and which will you replace?
5. What's fixed in the price, and what's the cap on the rest?
6. Will you check for signs of a break-in, and who fixes anything that breaks next week?

Someone who answers all six in writing is someone I'd trust with the job. "Don't worry, we'll take care of it" isn't an answer.

I can't tell you a PHP update is tax-deductible or grant-funded: I'm not a tax adviser, and when I checked on 24 October 2026 I found no Singapore grant that pays for a PHP update on its own. Ask your accountant how to treat it in your accounts. And if a provider tells you a grant will cover the PHP fix, ask them to name the grant and show you where it says so before you sign anything.

No. A PHP update is a one-off job, and a monthly plan only makes sense if nobody else will keep PHP, WordPress and the plugins current afterwards; mine starts at SGD 550 a month for 5 hours of changes, with updates, backups and security included.

The 10-hour retainer is SGD 950 a month. Both are month to month with 30 days' notice. PHP put out five security releases between May and October this year, so a site updated because of a news story will need the next one too. My website maintenance cost guide compares Singapore prices, and these signs tell you whether anyone is looking after your site now.