Forty photos from the last shoot, cleanly exported, are moving into the media library, and after the twelfth image WordPress reports an HTTP error. Behind such interruptions there may be a server limit: for image processing, WordPress requests additional memory, and whether PHP gets it is decided solely by the configuration at the host.
The differences between two plans are hidden in the fine print: which PHP version is running, how much memory an upload gets, who creates backups and whether you can restore them yourself. Here you will read which key data you should check before booking, which hosting model suits your project and how to check an existing installation.
What does WordPress require from the server?
WordPress recommends PHP version 8.3 or higher, MariaDB version 10.11 or higher or MySQL version 8.0 or higher, and HTTPS. In addition, WordPress needs a web server such as Apache or Nginx with the mod_rewrite module for readable URLs. The official requirements page of WordPress.org names nothing more, and the project itself stresses that the list is complete. Since WordPress 5.7, you can switch an existing site to HTTPS with a few clicks, as soon as the host has set up HTTPS for the domain.
Older environments with PHP 7.4 and MySQL 5.5.5 can still run WordPress. However, both versions have reached their official end of life, and WordPress.org warns about the security vulnerabilities.
A new project does not belong on such a server.
Why is the PHP version so important?
PHP is the programming language WordPress runs on, and each version receives security updates for a limited time only. The PHP project publishes the deadlines: for PHP 8.2, security updates end on December 31, 2026, so in a little over two months. Security fixes for PHP 8.3 are available until December 31, 2027, for PHP 8.4 until December 31, 2028, and for the currently newest version, PHP 8.5, until December 31, 2029.
PHP 8.3 has no longer received new features and regular bug fixes since December 31, 2025. The WordPress hosting handbook therefore advises operators of older versions to plan the switch now.
How long PHP versions stay secure
End of security updates according to the PHP project, as of October 2026
- December 31, 2026PHP 8.2 receives its last security updates
- December 31, 2027PHP 8.3, the minimum version recommended by WordPress
- December 31, 2028PHP 8.4
- December 31, 2029PHP 8.5, the currently newest version
Sources: PHP: Supported Versions, WordPress.org
For your plan, this means: the PHP version should be switchable in the customer menu, without a ticket and without a migration. According to WordPress, newer versions are also designed for better performance. The built-in Site Health tool classifies an outdated PHP version as a critical security issue and prompts you to update.
What does a website with many photos need?
A portfolio, a photo blog or a shop with product images burdens the server mainly during upload. After every upload, WordPress calculates several smaller versions of the image, and since version 5.3 additionally two high-resolution sizes for high-pixel-density displays. Photos that measure more than 2560 pixels on one edge are scaled down by WordPress to this value, and only the scaled-down file is shown on the website. According to the WordPress developers, the scaled-down version is up to ten times smaller than the original, which nevertheless remains in the upload folder.
Therefore, plan your storage space generously: each photo is stored on the server several times.
For image editing, administration and scheduled tasks, WordPress requests more memory for PHP when needed, but whether the server agrees is determined by the hosting.
It is best to ask before booking about the memory limit for PHP and the maximum file size for uploads.
The WordPress hosting handbook recommends the PHP extension Imagick for better image quality when uploading and for preview images of PDF files, provided Ghostscript is also installed on the server. A portfolio with PDF folders benefits from this, but Imagick is not available with every provider.
Shared, managed or your own server: What suits you?
With shared hosting, you share a server with other customers and manage WordPress yourself: updates, plugins and backups are your responsibility. Managed WordPress hosting takes some of this maintenance off your hands; which tasks exactly is stated in the plan's scope of services. Your own virtual server, VPS for short, gives you full control and thus also full responsibility for the operating system, web server and security.
Before booking a shared hosting plan, one question suggested by WordPress.org itself is worthwhile: does PHP run under your own user account or under an account shared by all customers of the server? According to the project's assessment, the first variant is the more secure one.
For a portfolio or the site of a small studio, in our experience a shared hosting plan with a selectable PHP version is sufficient.
Your own server is only worthwhile once you need services that no plan offers and want to take over system maintenance yourself.
Which key data do you check before booking?
Before you book hosting for the WordPress website, it is best to compare the plan description with the requirements of WordPress. PHP version, database and HTTPS belong in the data sheet, and if any information is missing, you ask before the contract.
This is what your hosting should offer
Key facts for a new WordPress website, as of October 2026
- PHP 8.3 or newer, switchable yourself in the customer menu
- MariaDB from version 10.11 or MySQL from version 8.0
- HTTPS for your domain
- Backups that you can restore yourself
- Test environment for updates
- Data processing agreement under Art. 28 GDPR
- PHP 8.2 or older as a permanent solution
Sources: WordPress.org, PHP: Supported Versions, Art. 28 GDPR
Ask about the backups: how often the provider makes them, how long it keeps the versions, and whether you can restore an individual backup yourself. How to additionally back up WordPress on your own is shown in the lesson on security and backups.
A backup you have never restored is like a spare key you have never tried: you only find out whether it fits when you are standing in front of a locked door.
A test environment, known in technical jargon as staging, copies your website to a second address. There you first install updates for your theme and plugins, but only apply them to the live site once nothing is stuck. Since WordPress 5.5, you can switch on automatic updates individually for each plugin and each theme; with a test environment behind you, this decision becomes easier. If you like to get hands-on yourself, also look for SSH access and the command-line tool WP-CLI.
Contact forms, comments, and orders contain personal data that the host stores on your behalf. Article 28 of the GDPR requires a contract for this that defines the subject matter, duration, nature, and purpose of the processing. You conclude this data processing agreement with the provider before the website goes online.
For speed, Google's developer portal web.dev gives a benchmark: the time until the first byte from the server, the Time to First Byte, is 0.8 seconds or less for good sites, and from 1.8 seconds it is considered poor. With a fresh test installation, you can measure the value yourself in your browser's developer tools; how to set up WordPress for this is shown in the lesson Installing WordPress.
WordPress becomes noticeably faster with an object cache such as Redis or Memcached. The WordPress hosting handbook lists both as extensions, of which one is enough.
How do you check a running WordPress installation?
If your website is already running, a tool that is built into every installation helps: under Tools › Site Health, WordPress checks its own configuration and sorts the findings into critical issues, recommended improvements, and passed tests. An outdated PHP version, non-functioning background updates, and a publicly visible error output end up there under critical issues.
The Info tab contains the technical data: PHP version, database, maximum upload size, the image library used, and whether the site uses HTTPS. With the export function, you copy all the information to the clipboard and, in case of problems, send it straight to your host's support.
What this means for you
For a fresh start in autumn 2026, we would no longer book a plan that locks in PHP 8.2 or does not let you switch the version. Security updates end in a good two months, and the switch would then fall in the middle of building your website. Three steps put you on the safe side:
- Before booking, check in the data sheet or by inquiry whether PHP 8.3 or newer, MariaDB 10.11 or MySQL 8.0, and HTTPS are available.
- In the first few weeks, restore a backup as a test, ideally in the test environment.
- For an existing website, open Site Health once and work through the critical points.
Once the server is set up, the real work with theme, pages, and media library begins. The course WordPress for Beginners accompanies you from installation to the finished website.
