The Internet Just Got Audited, and 70% of WordPress Is Running on a Dead Engine

Security researchers at Censys recently scanned the public internet and published what they found under WordPress’s hood. The numbers deserve every host’s attention: among publicly visible WordPress sites exposing version information, more than 70% were running outdated PHP. The single most common PHP version observed was 7.4, powering over a fifth of sites, a version that stopped receiving security patches in November 2022. Nearly four years dead, and it’s still the most popular engine on the WordPress web.

The researchers noticed something stranger, though, and it’s the detail that matters most for anyone running hosting infrastructure.

The Skew That Tells the Whole Story

The data shows WordPress itself is in comparatively decent shape: roughly a third of observed sites were on actively maintained WordPress versions. The same sites’ PHP told the opposite story. Sites are running reasonably current WordPress on top of profoundly outdated PHP.

Why would the same site be maintained at one layer and abandoned at the layer below?

Because the two layers have different owners. WordPress core updates itself, nags relentlessly, and lives inside a dashboard the site owner actually visits. PHP has no button in wp-admin. It’s a server-level runtime, invisible to the site owner, changeable only at the hosting layer. The application layer gets attention because someone is responsible for it. The runtime rots because, in practice, nobody is.

That’s not a site-owner failure. That’s an ownership gap, and it sits squarely on hosting infrastructure.

The Advice That Will Never Work

The standard prescription, repeated in the research and everywhere else, is that site owners should check for PHP updates every few months, plan migrations ahead of end-of-life dates, and keep pace with the runtime’s four-year lifecycle.

Read that advice against the audience it’s aimed at. The typical WordPress site owner is a restaurant, a clinic, a nonprofit, a small business that chose WordPress precisely so they’d never have to think about server software. They don’t know what PHP is. They can’t see which version they’re on. Even where a hosting panel offers a version switch, flipping it is the easy part; they have no way to know whether the click will break the plugin holding their contact form together, and no ability to fix it when it does.

Twenty years of this advice produced the current number: 70% outdated. The advice isn’t wrong because it’s inaccurate. It’s wrong because it’s addressed to someone who structurally cannot act on it. PHP lifecycle management is fleet work, and fleets belong to hosts.

What the Attackers Already Understand

The same research documents an active defacement campaign that has hit hundreds of WordPress sites, with victims sharing a familiar profile: outdated software and default misconfigurations. No sophisticated tooling, no novel exploit, just patient scanning for sites that fell behind. The researchers’ own framing is apt: these attacks don’t require skill, they require a target that stopped keeping pace.

Every one of those compromised sites sits on somebody’s infrastructure. When it gets defaced, the site owner blames the host, the support ticket lands on the host, and the cleanup cost lands on the host. The exposure was always the host’s problem. The industry just hasn’t been treating it that way.

The Host-Side Answer: Every Legacy Site Gets a Lane Out

At WP Maintain we build for exactly this gap, and the model starts from the honest premise the data demands: the site owner is never going to manage the runtime, so the platform has to.

First, see the problem. The PHP Version Monitor gives a host real-time visibility into every site’s runtime across the fleet, flagging end-of-life and approaching-end-of-life versions automatically. The 70% stops being an internet statistic and becomes a named list of your sites, each one audited against the target PHP version and sorted by what it will take to move it.

Then, every legacy site gets a lane out. Sites that can move get managed PHP Upgrades: audit, fix the incompatible plugin and theme code, prove it on staging, migrate with rollback standing by. For hosts under a volume agreement the upgrade is included with WP Care+ on every enrolled legacy site, so the fleet moves without a per-site sales conversation. Sites worth reinvesting in get rebuilt on a modern stack. Sites that never change, the brochure sites and finished projects that make up so much of that 70%, can be converted to Managed Static instead, where WordPress stays the CMS and no PHP executes on the public site.

And while a site waits its turn, it is not unpatched. It sits on the WP Care plan it is already on, with scanning, safe updates, backups and monitoring, and on WP Care+ with virtual patching at the application layer, plugins and themes, which is where the overwhelming majority of WordPress compromises actually enter and where runtime patching alone offers nothing. Protection is part of the plan the customer is already on, not a product bought to stay old.

For hosts already billing extended PHP support, the lane is a conversion. Enroll the fleet, upgrade what moves, and change the SKU from extended PHP to WP Care at the same price. The customer gets a current, maintained site. The host keeps the revenue and stops paying, in engineering time or vendor fees, to keep alive runtimes the PHP project abandoned years ago.

Upgrade or rebuild, every legacy site in one of them, none of them left as an unpatched engine waiting for a scanner to find it.

The Reframe Hosts Should Take From the Data

Seventy percent outdated PHP is not just risk sitting on your servers. It is the largest unserved maintenance market on the internet, pre-identified, sitting inside fleets hosts already bill every month. The sites are found, the customer relationships exist, and the site owners have proven for two decades that they will never solve this themselves. The hosts that build runtime lifecycle into their platform turn the internet’s worst statistic into a recurring care relationship, a modernized fleet, and a legacy count that goes to zero one version at a time. The ones that keep forwarding the advice to site owners will keep appearing in next year’s scan.

The internet audit already happened. The only question left is who takes responsibility for the result.