Check your WordPress plugins and themes for PHP 8.3, 8.4 and 8.5 problems
Before you move a site to a newer PHP version, find out what will stop working. This free plugin reads the code of every plugin and theme on your site, and the PHP files directly inside the mu-plugins folder, and shows, for each problem, the file, the line, the PHP version that changed it and what to do about it.
Free and open source. The plugin is in review at the WordPress plugin directory; this page links to the listing as soon as it is public.
Read the plugin compatibility guide PHP 8.2 end of life
GPL v2 or later. Needs WordPress 6.0 or newer and PHP 7.4 to 8.5. There is also an optional paid add-on.
my-plugin/includes/legacy.php
function get_owner( WP_User $user = null ) {What happens: Parameter $user has type WP_User and default null.
Fix: Write ?WP_User $user = null.
What the report shows
One line per plugin, theme and must-use plugin, worst first, each with a plain verdict:
- Breaks on PHP 8.4 The code fails on that version, or uses a setting PHP no longer has.
- Deprecated It still runs, and PHP logs a deprecation notice.
- No PHP 8.3-8.5 changes found by this scanner. It found none of the changes it knows about in the files it could read. This is not a guarantee.
- No changes found in the files read Some files could not be read, so this covers only the rest. The number of files not scanned is shown under the name, and the reason is inside the row.
Open a line to see every finding: the file, the line of code, the PHP version that made the change, what happens, what to do and a link to the matching page of the PHP manual. A finding inside a bundled library (a vendor or lib folder) is marked, because the fix there is an updated plugin, not an edit.
A switch shows changes up to PHP 8.3, 8.4 or 8.5. Every line has a Re-scan button for after you update a plugin, and the report downloads as a CSV file built in your browser.
How a scan works
- Install and activate the plugin from the WordPress plugin directory.
- Press Scan this site. It is under Tools > PHP Compatibility. Pick the PHP version you plan to move to (8.3, 8.4 or 8.5), and whether to include inactive plugins and themes.
- Let it run. The scan works in steps of about three seconds and shows a progress bar. If you close the page or lose the connection, you can resume where it stopped.
- Read the report. Update anything that shows an update, then press Re-scan on that line. If there is no update, send the finding to the plugin’s developer.
Built for shared hosting
Each step is short, so a slow host is held up by one short step at a time, not by one long request. The list of files is built when a scan starts and can take a few seconds on a site with tens of thousands of files.
- Steps of about three seconds, with a progress bar and a Cancel button.
- A scan you left can be resumed where it stopped.
- A file that crashes PHP while it is read is skipped and listed with the reason. The scan carries on.
- Files are read one at a time. A file too large for the free memory of your host is skipped and listed, so a low memory limit does not stop the scan.
Nothing leaves your site
The plugin makes no requests of its own to any server. It loads no outside scripts, fonts or images, and it collects no data. The links to the PHP manual and to this site open only when you click them.
You can check this yourself: open your browser’s developer tools, go to the Network tab, run a scan, and read the list of requests. The requests the scan makes all go to your own site (admin-ajax.php). WordPress itself may load other things on the screen, such as avatars.
What it checks, and what it does not
| PHP version | Rules | Removed | Deprecated |
|---|---|---|---|
| PHP 8.3 | 13 | 3 | 10 |
| PHP 8.4 | 22 | 3 | 19 |
| PHP 8.5 | 20 | 2 | 18 |
| All three | 55 | 8 | 47 |
Removed means the code fails on that version (a fatal error, a TypeError, an undefined function or constant) or relies on a setting PHP no longer has. Deprecated means it runs and PHP logs a deprecation. Before each rule shipped, it was run on a real PHP build of the version that made the change. Examples: implicitly nullable parameter types (PHP 8.4) and non-standard cast names such as (integer) (PHP 8.5).
Not checked
- Changes made in PHP 8.2 and earlier. A site on PHP 7.4 or 8.0 needs a tool that also covers those versions.
- Dynamic code, such as
$fn()orcall_user_func( 'name' ), and methods called on an object whose class the scanner cannot know. It reads your code and runs none of it. - Changes that only show while the code runs, such as a function that now returns a different value.
- Files over 2 MB and files too large for the free memory of your host. They are skipped and listed with the reason.
It does not edit your code. It tells you where to look; fixing a plugin is up to its developer or you.
How accurate is it?
On 1 November 2026 we compared the scanner with PHPCompatibilityWP, a PHP_CodeSniffer ruleset that checks WordPress code for PHP version problems. The test used 40 popular plugins and 10 popular themes from wordpress.org, chosen by active installs: 28,675 PHP files.
| Measure | Result |
|---|---|
| Lines PHPCompatibilityWP reports | 344 |
| Of those, also reported by this scanner | 344 (8.3: 14 of 14, 8.4: 264 of 264, 8.5: 66 of 66) |
| Lines this scanner reports | 365 |
| Reported only by this scanner | 21, each checked on real PHP 8.4 or 8.5: none was a false alarm |
What this does not show
- The comparison is against another tool, not against all of PHP. Both tools miss dynamic code.
- Popular plugins carry many bundled libraries, so rare constructs have few samples.
- Only changes made in PHP 8.3 to 8.5 were compared. PHP 8.2 and earlier are not covered.
- The first run matched 342 of the 344 lines. The two it missed were fixed afterwards, using these same files, so 344 of 344 is the result after that fix, not a first-try figure.
- Files over 1 MB were left out of the comparison on both sides. PHPCompatibilityWP ran with its ignore comments (
phpcs:ignore) switched off, because they hid real findings.
A result of “no changes found” means this scanner found nothing. Test the upgrade on a staging copy before you change PHP on a live site.
Hexloom Pro: re-scan after updates, report by e-mail
The free plugin does everything above and stays free. Hexloom Pro is a separate add-on from Hexloom Labs. It changes when scans run and who is told, not what the scanner finds.
- It notices when a plugin or theme is updated, one at a time or in bulk, and re-scans only the updated items soon afterwards, in the same small steps. It uses the WordPress scheduler, which runs when a visitor loads a page.
- When an update leaves findings, it sends one plain-text e-mail from your own site, through the same mail function WordPress uses for its other messages. You choose whether to be told only when an update leaves findings, after every update scan, or never, and you can set up to three recipients.
- Price
- USD 29 for one year, plus tax where it applies.
- Covers
- One site address. It does not renew by itself.
- Licence
- A key shown after payment and sent by e-mail. It is checked inside the add-on, so nothing is sent to Hexloom Labs to verify it.
- Checkout
- Open to buyers in Canada and the United States.
- Status
- Not on sale yet. It goes on sale when the free plugin is listed on WordPress.org.
Questions
Does it change my site?
No. It never edits your plugins, themes or files. It saves its progress and the last results in your database; the Reset link, or deleting the plugin, removes them.
Why only PHP 8.3 to 8.5?
That is where most sites are about to move: PHP 8.2 stops getting security fixes on 31 December 2026. The PHP 8.2 end of life guide has the dates and a safe order of work.
Does a clean result mean a plugin is safe?
No. It means the scanner found none of the changes it knows about in the files it could read. Dynamic code cannot be seen, and files over 2 MB are skipped. Test on a staging copy first.
A plugin shows “update available”. What should I do?
Update it, then press Re-scan on its line. The developer may already have fixed what the scanner found.
Which versions does the plugin run on?
WordPress 6.0 or newer (tested up to 7.1) and PHP 7.4 to 8.5. It needs the PHP tokenizer extension, which a normal PHP install includes; if it is off, the plugin says what to ask your host. On a multisite network, activate it for the network and open Settings > PHP Compatibility in the Network Admin. Only super admins can use it. The network screen was checked by reading the code and has not been run on a live network yet.
A finding looks wrong. Where do I report it?
Use the support page and say which plugin and file, so it can be checked.
Guides and comparison
- PHP 8.2 end of life: what to do before 31 December 2026
The dates, which PHP version to move to, and a safe order of work. - Is my WordPress plugin compatible with PHP 8.3?
Ten common changes, each with the code before and after. - An alternative to the PHP Compatibility Checker plugin
A side-by-side with the WP Engine plugin, with sources and dates.