Site Health PHP check shows inaccurate status

[swb1192]

Site Health has a PHP check that returns a string related to the status of the PHP version. It should state if the PHP version is the latest version, an older (but supported) PHP version, or an older and insecure PHP version.

However, the current result states all supported versions are the "current version" of PHP.

To reproduce:

• Set up a WordPress installation
• Configure PHP as version 7.4 (supported but insecure and not the latest version)
• Go to Tools > Site Health
• View the Passed Tests

See:

"Your site is running the current version of PHP (7.4.30)"

Expected:

"Your site is running on an outdated version of PHP 7.4, which does not receive security updates. It should be updated."

[swb1192]

screenshot running php 7.4

[swissspidy]

This happens because PHP 7.4 is still the ​recommended version, so this is expected. See ​https://github.com/WordPress/wordpress-develop/blob/9cff1de6b3adcf8767bfc60c4e71b5cce81f0e1b/src/wp-admin/includes/class-wp-site-health.php#L758-L761

[swb1192]

@swissspidy Please re-open this ticket. The issue is not about whether PHP 7.4 is supported or not. The issue is that it says 7.4 is the current version of PHP. It may be recommended, but it's not the current version of PHP.

[swissspidy]

I didn't close the ticket. It is still open, the close just says closing is suggested.

[swb1192]

Got it, thank you. I can adjust the ticket copy if the intent or issue was unclear.

Updates the Site Health PHP check message to correctly refer to the currently recommended version of PHP, not the current version of PHP

Trac ticket: https://core.trac.wordpress.org/ticket/61623

[psykro]

Looking at the code, the text needs to match any version of PHP that is equal to or greater than the recommended version.

So instead of

Your site is running the current version of PHP

It could say

Your site is running at least the minimum recommended version of PHP

This way, if the PHP version exceeds whatever the current recommended version is, the wording still makes sense.

EDIT: the Github bot was quicker than I was, the patch was meant to come after the comment.

[joemcgill]

I think clarifying the wording for this health check makes sense. What doesn't make sense is that we are showing this success message also when wp_check_php_version() returns false due to an error validating the /core/serve-happy API response. We could consider changing that behavior as part of this ticket but shouldn't be blocking.

I'm also tagging for the performance focus given that this is labeled as a performance check.

[swb1192]

@psykro Thanks for the patch. Perhaps better wording could be:

Your site is running a recommended version of PHP.

[mukesh27]

Hi there!

This ticket was discussed on today's performance bug scrub.

The next step should be update site health copy text.

Move in to 6.7 for visibility.

Additional props: @swissspidy @joemcgill

[psykro]

Replying to swb1192:

@psykro Thanks for the patch. Perhaps better wording could be:

Your site is running a recommended version of PHP.

Yup, you're probably right, I'll update the patch.

[SergeyBiryukov]

In 58832:

Site Health: Improve the wording for PHP version check.

This aims to make the message more accurate by referring to the version of PHP currently recommended by WordPress, not the current version of PHP.

Follow-up to [44986], [46267], [47254].

Props swb1192, psykro, swissspidy, joemcgill, mukesh27, aristath.
See #61623.

Thanks for the PR! Merged in r58832.

[SergeyBiryukov]

Thanks everyone! Keeping the ticket open for now to also address comment:7.

[amin7]

I have tested the patch.

Test Report

Patch tested: ​https://patch-diff.githubusercontent.com/raw/WordPress/wordpress-develop/pull/7011.diff

---

Steps to Test ( As per description)
Set up a WordPress installation
Configure PHP as version 7.4 (supported but insecure and not the latest version)
Go to Tools > Site Health
View the Passed Tests

Environment

WordPress:6.6.1
Browser: Firefox 128.0
PHP: 7.4.3
Theme: TT4
Plugins: none

Before patch

Check the screenshot: ​https://d.pr/i/5ENYFo

After patch
Check the screenshot ​https://d.pr/i/KI4zYY

Results
The patch is working as suggested

Refactor the logic for setting the PHP version label and status in the site health check. Adds a condition to handle failures in obtaining the recommended PHP version from WordPress.org, updating the label and description accordingly.

[pbearne]

Replying to joemcgill:

I think clarifying the wording for this health check makes sense. What doesn't make sense is that we are showing this success message also when wp_check_php_version() returns false due to an error validating the /core/serve-happy API response. We could consider changing that behavior as part of this ticket but shouldn't be blocking.

I'm also tagging for the performance focus given that this is labeled as a performance check.

I have added patch to adjust eh message if the call to wp.org fails

@joemcgill @SergeyBiryukov Could you please take a look when you have moment so we can commit it before RC.

[krupajnanda]

Test Report

Description

This report validates whether the indicated patch works as expected.

Patch tested: ​https://github.com/WordPress/wordpress-develop/pull/7350

Environment

• WordPress: 6.7-alpha-58576-src
• PHP: 8.2.15
• Server: nginx/1.25.3
• Database: mysqli (Server: 8.0.36 / Client: mysqlnd 8.2.15)
• Browser: Chrome 129.0.0.0
• OS: macOS
• Theme: Twenty Twenty-Four 1.2
• MU Plugins:
  • Safe Autoloaded Options Limit Test (MU Plugin) 1.0
• Plugins:
  • Test Reports 1.1.0

Expected Results

Text should be updated to : "Your site is running a recommended version of PHP (%s)"

Actual Results

Text is updated after the patch is applied. ✅

Supplemental Artifacts

Add as Attachment

[krupajnanda]

@pbearne I am not sure how can I test this scenario:

Your site is running PHP Version (%s) but the call to get the recommended version failed.

[peterwilsoncc]

@SergeyBiryukov @joemcgill Are either of you able to take a quick look at the follow up PR and see if it addresses comment 7

[SergeyBiryukov]

Would like to do some more testing here, moving to 6.8 for now.

[joemcgill]

Agreed. I left some feedback on the PR last week that hasn't all been addressed. I think this needs a bit more thought.

[flixos90]

@joemcgill It looks like @pbearne replied to your last feedback. It's not fully addressed, but I think based on his reply it would be great if you could check in again with your proposed approach.

[imranhasanraaz]

Test Report

Description

I have tested on 6.8-beta1-59933-src with php 7.4. The text is updated there.
It is showing 'Your site is running a recommended version of PHP (7.4.33)'

Patch tested: REPLACE_WITH_PATCH_URL

Environment

• WordPress: 6.8-beta1-59933-src
• PHP: 7.4.33
• Server: nginx/1.27.2
• Database: mysqli (Server: 8.0.40 / Client: mysqlnd 7.4.33)
• Browser: Chrome 133.0.0.0
• OS: Windows 10/11
• Theme: Twenty Twenty-Five 1.1
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.1.0

Actual Results

✅ Text is updated -

[vgnavada]

Hey there!

Is the pull request playground link working properly?
​https://playground.wordpress.net/wordpress.html?pr=7350

I tried from 2 different browsers, it's crashing everywhere!

[audrasjb]

As per today's bug scrub and since 6.8 beta 3 is tomorrow and it's still being discussed, let's move this ticket to 6.9.

[Presskopp]

Dashboard:
Your site is running on an outdated version of PHP (8.4.4), which does not receive security updates. It should be updated.

Site Health:
Your site is running on an older version of PHP (8.4.4)

...\wp-admin\includes\dashboard.php:44:
array (size=6)
  'recommended_version' => string '8.4.8' (length=5)
  'minimum_version' => string '7.2.24' (length=6)
  'is_supported' => boolean true
  'is_secure' => boolean false
  'is_acceptable' => boolean false
  'is_lower_than_future_minimum' => boolean false

@joemcgill Do you feel your feedback has been addressed?

[westonruter]

I think this is good to go. Just pinged a reviewer to confirm concerns have been addressed.

[westonruter]

I added a couple comments to the PR with ideas for how it might be improved further.

@pbearne It looks like the last feedback is addressing what Peter found in ​https://github.com/WordPress/wordpress-develop/pull/7350#pullrequestreview-3396830402

While testing without been able to connect to the WordPress API, I noticed that a passing request to the API does not show the recommended version of WP.

@peterwilsoncc Now it shows as:

When wp_check_php_version() returns:

array(
        'recommended_version' => '10.0.0',
        'minimum_version'     => '9.0.0',
        'is_supported'        => false,
        'is_secure'           => false,
        'is_acceptable'       => false,
)

When:

$response = array(
        'recommended_version' => '10.0.0',
        'minimum_version'     => '8.0.0',
        'is_supported'        => true,
        'is_secure'           => true,
        'is_acceptable'       => true,
);

When:

$response = array(
        'recommended_version' => '8.0.0',
        'minimum_version'     => '7.2.0',
        'is_supported'        => true,
        'is_secure'           => true,
        'is_acceptable'       => true,
);

[westonruter]

In 61123:

Site Health: Improve messaging for PHP version status.

Previously, the status could be misleading, especially if the check against the WordPress.org API failed. The initial status message is now more neutral, and a dedicated check has been added to handle cases where the API is unreachable.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/7350

Follow-up to [58832].

Props pbearne, joemcgill, mukesh27, peterwilsoncc, swb1192, krupajnanda, psykro, SergeyBiryukov, swissspidy, imranhasanraaz, amin7, flixos90, vgnavada, audrasjb, adamsilverstein, Presskopp, westonruter.
Fixes #61623.