Hosts are moving sites off old PHP versions: PHP 8.1 gets no security fixes since the end of 2025, PHP 8.2 loses them at the end of 2026. For a WooCommerce shop the question is always the same — will the checkout still work after the switch?

PHP Upgrade Check reads the code of your plugins and themes and compares it with what changed in PHP from version 7.0 to 8.5. It runs on the PHP you have today (7.2 or newer) and tells you, before anything is switched, which plugins will stop working on the version you are moving to.

The report

Pick the PHP version you are moving to: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 or 8.5. The report switches between versions without scanning again.
A verdict for every active plugin and theme, must-use plugins and drop-ins: Will break, Encoded — ask the vendor, Works differently, Deprecation notices, Ready.
For every finding: the file, the line, the code, what changed in PHP, since which version, and how to fix it, with a link to the PHP migration guide.
Plugins with an update waiting are marked “update first, then scan again” — when the update itself supports the new PHP.
WooCommerce extensions are marked, so you know which of them touch the shop.
CSV export (comma or semicolon) for your developer, your host’s support or the plugin’s author.
A Site Health test: Tools Site Health shows how many active plugins would break.
WP-CLI: wp catcode-php-check scan, wp catcode-php-check report --target=8.4, wp catcode-php-check export report.csv.

What it finds

Code that no longer loads at all — the whole file fails: curly-brace offsets ($text{0}), nested ternaries without parentheses, the (real) and (unset) casts, =& new, classes named after new reserved words (mixed, never, readonly, match), a function called match() or __autoload().
Removed functions: each(), create_function(), get_magic_quotes_gpc(), money_format(), split(), the ereg family and many more.
Extensions taken out of PHP: mysql_* (PHP 7.0), mcrypt_* (7.2), xmlrpc_* (8.0), imap_*, pspell_* and oci_* (8.4).
Removed constants, calls that turned into fatal errors (implode() with the array first, parse_str() without a result, mktime() without arguments), and code that silently does something else: old-style constructors that no longer run, is_resource() on handles that became objects, define() with case-insensitive constants, assert() with code in a string, preg_replace() with /e.
Deprecations of every version up to 8.5: implicitly nullable parameters (8.4), missing return types on Countable, ArrayAccess, Iterator, JsonSerializable and other PHP interfaces (8.1), utf8_encode() (8.2), strftime() (8.1), FILTER_SANITIZE_STRING (8.1), E_STRICT (8.4), CSV functions without the escape argument (8.4), curl_close() and imagedestroy() (8.5), the backtick operator and non-canonical casts (8.5) and others.
ionCube- and SourceGuardian-encoded files — they cannot be read, so the report tells you to ask the vendor.

Code that already copes with both versions — inside a check of the PHP version, function_exists(), extension_loaded() or defined(), or a plugin that ships its own replacement of a removed function — is shown as “guarded” and does not count against the plugin.

Your server

The PHP version, until when it gets security fixes, and whether a newer patch release of the same branch exists (with a note about Linux distributions that backport fixes without changing the number).
Whether your WordPress version supports the PHP you are moving to, and the PHP version WooCommerce needs.
The ionCube Loader, and the extensions loaded today that the new PHP no longer ships.

How it works

The plugin reads the PHP files with PHP’s own tokenizer. Nothing is executed, included or changed, and no code leaves your server. The scan runs in short steps, so a shop with WooCommerce and dozens of plugins does not hit the server’s time limit; you can leave the page and continue later.

A scan of the code cannot see everything that happens while the site runs — for example a null passed to a PHP function or a property created on the fly. Such cases appear as deprecation notices in the PHP error log after the switch.

External services

When “Latest PHP releases” is on (the default), the plugin asks php.net which release is the latest in each PHP branch and until when each branch gets security fixes, so it can tell you whether your PHP is up to date.

Service: php.net release information, https://www.php.net/releases/branches.php
When: when the plugin’s screen or the Site Health test needs the data, at most twice a day (the answer is cached for 12 hours).
Data sent: none besides the request itself (your server’s IP address and a standard WordPress user agent, as with any web request). Nothing about your site, plugins or users is sent.
Terms and privacy: https://www.php.net/license/ and https://www.php.net/privacy.php

Switch it off under Tools PHP Upgrade Check Settings; the plugin then uses the list of releases built into it.

CatCode PHP Upgrade Check for WooCommerce

External services