Upgrade Your Craft CMS Site to PHP 8: It's Business Critical

Keeping your Craft CMS site up to date is always important. The overall technology stack that powers Craft is also crucial to your site's security and performance. But sometimes, life happens and you forget to upgrade. Or maybe you have too many other projects and haven't prioritized it. Or maybe the thought of upgrading is just too scary. Whatever it is, don't worry – you're not alone! Investing time now for the upgrade could save considerable time and resources in the future by preventing security breaches and performance bottlenecks as well as improving future maintainability.

The Case for Upgrading

Craft 4 was released in May 2022 and requires PHP 8. This means if you have any plans to upgrade to Craft 4 (and you should!), you'll need to upgrade PHP as well. But upgrading PHP doesn't require you to upgrade Craft. PHP 8 has been supported since Craft CMS 3.6. Upgrading PHP first can make the transition to Craft 4 much smoother and quicker as you'll be able to check what custom code needs updating and get your plugins up to date for PHP 8 and Craft 4. This is a good idea to do first – especially since sites that don’t get updated regularly tend to have plugins or build tools that are no longer maintained or compatible. Because of this, you may need to swap plugins with replacements as well as upgrade libraries and build tools to keep your setup working smoothly post-upgrade.

Maintainability

While you may not see updating PHP as something that can speed up your site, it really can make a difference! There have been several improvements made in PHP 8 that can reduce the time it takes to run your code. Features like the JIT (Just In Time) compiler can improve the time it takes to interpret your code, while other improvements to typing, constructor promotion, and null coalescing can improve the quality, readability and reliability of your Craft modules. All of these can help improve your site’s performance and end-user experience, reduce security risks, and make it easier and faster to maintain over time.

Performance

Upgrading from PHP 7.4 to 8.x can have an immediate effect on your site. PHP 8 is fast; but don't take my word for it. Take a look at the test results from Kinsta below.

A faster website can mean a few things. For one, search ranking can improve with a quicker page load time. You also open your audience up to more users whose computers and devices may not be as powerful. A page load time of under 3 seconds can also help improve conversion rates and reduce drop-offs. There are many reasons to address performance on your site!

Security

The security risks of not upgrading to PHP 8 should not be taken lightly. As of November 3, 2022, PHP 7.4 has reached its end of life (EOL). This means that active development has stopped and there won't be any more updates released or security patches – if your Craft site is still running PHP 7.4, it's vulnerable. If a new bug is discovered, it will not be fixed – at least not by the PHP Core Team. This makes your site an attractive target for a hacker looking for sensitive data.

Remember that not only is Craft CMS running on PHP, your site may also be running custom modules or third-party plugins as well. Those other packages also run on PHP and could pose their own threats. Upgrading to PHP 8 can reduce the risk of an attacker discovering a vulnerability across your site’s infrastructure or codebase and exploiting it. Regular updates to your platform should be treated as critical to the success of the site. There are several known and documented vulnerabilities that can crash your site, leak information or execute remote code.

The Upgrade Process

Now that you’re aware of the risks and vulnerabilities associated with running an out of date PHP version, let’s take a look at what it takes to get your Craft site upgraded to PHP 8.

The Challenges

The most difficult part is getting all your sites’ build tools and dependencies working with your new PHP version. It can feel a bit like whack-a-mole.

1. Change a version of something
2. Run composer update
3. Something else breaks
4. Repeat

There are a couple things you can do to make this process easier. The first tool you can leverage is a Composer command to audit your list of required packages and determine which will need to be updated to support PHP 8. Try running this command and don't be alarmed if you see a lot of packages listed.

composer why-not php 8

From here, you now have an idea of what needs your attention. My typical process is to:

1. Search for the package I need on Packagist or the Craft Plugin Store and find the current version.
2. Check the change log and make sure the current version doesn't break anything else that would need to be updated.
3. If it passes the gut check, I'll require that version in composer.json and run composer update. The output from this will let me know if we broke any other dependencies that need to be fixed as well.
4. I keep repeating this until we've addressed all the packages in the list from our why-not command above.

Once you've completed upgrading your packages and plugins, you might find that there are some that don't have updates or are custom modules you wrote yourself that aren't ready for PHP 8. In this case, the platform config in your composer.json file is your friend. If you don’t have it, add it. You will want your platform config set to your target version of PHP eventually. But for now, you can switch to PHP 8 and leave this as follows:

Because we're telling Composer your application is running 7.4, it won't complain about older packages that require PHP 7. Since you're actually running PHP 8, the code that relies on deprecated changes will break. This allows you to see the changes you'll need to address either in a fork or in your module. Once you've fixed all these issues, set your version back to your target version of PHP 8.

Refactoring Code

The process of updating your code for PHP 8 can take some time, but the good news is that the hardest part is tracking down and updating dependencies. There are many tools available to analyze your code and provide recommendations. A couple tools I like are:

Rector

Rector allows you to automatically upgrade. It rewrites code for you and does a pretty good job of it! It can really cut down the time it takes to upgrade by handling the code changes for you.

Rector also allows you to maintain code quality by enforcing some rules automatically. A fantastic bonus!

PhpStorm

PhpStorm is my IDE of choice; there are some great code inspection tools built right in. By setting the language level to 8.x, I can run inspections on a single file or my entire project and see a list of warnings due to code smells, bugs, compatibility, etc.

PHPStan

PHPStan is a powerful tool that allows you to find bugs in your code separately from testing. It allows you to scan your codebase and look at issues that don’t just relate to a test you wrote. Due to its level-based rules, you won’t get overwhelmed when trying it out. It can also be very useful in upgrading your Craft site, as there is a set of rules for detecting deprecated methods, classes, properties and traits.

This tool can be extremely helpful in finding all of the code in your modules, whether it’s in your code or in third party code you’re using.

Final Thoughts

If you've taken the time to read this post, you understand that running unsupported versions of PHP isn't something to be taken lightly. At this point, the costs far outweigh the benefits (there are none) to remaining on PHP 7.4. Plus, it’s not a terribly large level of effort to upgrade – the Craft team and many plugin developers in the Craft world have really embraced modern PHP and have made the transition a relatively painless and pleasant experience.

So, I hope I inspired you to upgrade to PHP 8 as soon as possible. Make a plan to upgrade to Craft 4 while you're at it! Keeping your PHP, Craft and dependencies’ versions up-to-date is an investment in the long-term success of your Craft CMS site. If this is something you need assistance with, Viget would love to help!