Airworthy – PHP Compatibility & Upgrade Checker

No. It only reads files and reports. You change the PHP version yourself, usually in your hosting control panel, when you're ready.

Airworthy reads the code without running it. That catches most PHP upgrade problems: functions, classes and constants that were removed, changed syntax, removed extensions, and new reserved words. It sees every file, including code paths your visitors rarely trigger. It can't see what only happens when code runs. For example: code that builds function names at run time, behaviour that depends on your data or settings, and problems in files a plugin downloads or generates later. Some newer PHP changes (such as a few PHP 8.1, 8.5 and 8.6 deprecations that depend on the values code passes around) can't be detected reliably by reading code yet. So a "Ready" verdict means no problems were found, not a guarantee. Test on a staging copy of your site, and keep a backup, before you switch.

No. Airworthy reads code without running it, so some problems can't be seen this way: code that only fails when it runs with your data or settings, your server's configuration, or other software on your site. Treat the results as guidance for planning. Before changing PHP on your live site, back up your files and database, try the new version on a staging copy and check the pages that matter most (checkout, forms, logins), and make sure you know how to switch back. Airworthy is free software provided without any warranty (see the licence), and DigitalKind isn't liable for the results of changing your PHP version.

Airworthy compares the PHP version your site runs now with the one you're moving to. Only PHP changes in between can break something when you upgrade. Code hit by an older change (for example a function removed in PHP 7.0, on a site that already runs PHP 8.3) either never runs on your site or is already failing today, and upgrading doesn't change that. Those findings are still listed in each plugin's details, but they aren't counted as Blockers. If you're checking a copy of a site that runs on another server, choose its PHP version under "Compare from another PHP version".

• Blocker: needs attention before you upgrade. Some of its code will not work on the PHP version you picked, or it needs a newer PHP version than that.
• Unknown: some files could not be checked, so there's no verdict yet. The details list which files and why.
• Suppressed: the author marked some code as intentionally left as-is. Most of the time that's fine, but worth confirming with them.
• Guarded: it contains code for old PHP versions, but only runs it on those versions. Nothing to do.
• Warnings: it works, but uses features that are being phased out. Nothing breaks now; the author should update before a future PHP version.
• Ready: nothing that would break on the PHP version you picked.

Nothing, unless you allow it when you start a scan. If you do, only each plugin's slug (its folder name), to look up its public directory entry: not your site address, not your PHP version. See Privacy above. Themes aren't looked up.

Start with "What to do first" under the overall answer: it puts the steps in order for your site. Update the plugin first, if an update is available; Airworthy checks it again by itself afterwards. If it's still a Blocker, open its details: each finding explains what would happen and how it's fixed. Use Copy summary or the CSV to send the findings to the plugin's author or your developer. If the plugin was closed on WordPress.org, look for a maintained replacement.

Scans run in the background in short batches of about 20 seconds, using WordPress's own scheduled tasks (Action Scheduler). Visitors aren't affected. A typical site with 20–30 plugins takes a few minutes; Airworthy estimates the time before you start.

PHP 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 and 8.6. Versions that no longer get security fixes are marked as ended; you can still check them, but results for them are less precise. Until PHP 8.6 is released on 19 November 2026, it's marked as a release candidate and is never suggested by default.

Yes. PHP 8.6 doesn't remove any functions or extensions, so it shouldn't break a site that works on PHP 8.5. It deprecates about 30 things, such as spl_object_hash(), is_long() and is_integer(), return inside a finally block and returning a value from a constructor. Code that uses them still works on 8.6 but will stop working in a later version, so Airworthy shows them as Warnings, with the replacement. PHPCompatibility, the open-source ruleset Airworthy builds on, doesn't cover PHP 8.6 yet, so these checks are Airworthy's own (in the plugin's standards/Airworthy folder). A few 8.6 deprecations only show when code runs, with particular values, and can't be found by reading code.

WordPress 7.0 needs PHP 7.4 or newer. On PHP 7.2 or 7.3, WordPress won't offer the update, so the site stays on WordPress 6.9. The way forward is a newer PHP version, and that's what Airworthy checks for: it runs on PHP 7.2 and up, so install it on the site as it is. Then check your plugins and theme against the version your host can move you to. Aim for PHP 8.2 or newer rather than 7.4, which no longer gets security fixes. Once the PHP switch is done, WordPress offers the update as usual.

That menu comes from Action Scheduler, the background-job library Airworthy uses (WooCommerce uses the same one). It's harmless, and lists Airworthy's jobs under the "airworthy" group.

No. Every verdict, finding, explanation and export is free, on as many sites as you like, with no account, licence key or sign-up. The scan runs on your own server, and your plugins' code never leaves your site. The only outside request is the optional WordPress.org lookup, which you choose before each scan and which sends only plugin folder names (see Privacy).

Yes. Airworthy is free and GPL-licensed, with no limit on sites and no account. Agencies often run it from WP-CLI (wp airworthy scan --target=8.4 --fail-on=blocker) across all their sites, and use Copy summary or the CSV export for each client.

No. Airworthy doesn't patch PHP or block attacks; only a PHP update from your host does that. What it does is tell you whether your server's PHP has the latest PHP security fixes it knows of (currently the release of 21 October 2026, which fixed those two), on its start screen, in the results and in Tools > Site Health. A version number alone can't settle that: hosts on CloudLinux, cPanel, Plesk, Debian, Ubuntu or Red Hat ship the fixes as an update that keeps the old version number. So Airworthy also reads when your PHP was built. Built on or after the release day, it very likely has the fixes (Airworthy says so, and suggests confirming with your host). Built before, on one of those hosts, Airworthy asks you to get your host to apply the PHP update. Built before anywhere else, it's flagged as missing the fixes. When the build date can't be read, Airworthy says it can't tell from the version alone and to ask your host. The release data is bundled with the plugin, so Airworthy learns about a new PHP security release when it is itself updated.

Email security@airworthywp.com. Please don't post it in the public support forum. See SECURITY.md in the source repository for how reports are handled.