Recommended versus legacy
WordPress.org publishes two tiers. The recommended set is what a new site should run. The legacy note exists for older environments: WordPress also works with PHP 7.4+ and MySQL 5.5.5+, but WordPress.org says these versions have reached their official end of life and may expose a site to security vulnerabilities. A host that only offers the legacy tier is running versions past end of life.
| Component | Recommended | Still works (legacy) | Why it matters |
|---|---|---|---|
| PHP | 8.3 or greater | 7.4+ | Executes WordPress and every plugin on each uncached request |
| Database | MySQL 8.0+ or MariaDB 10.11+ | MySQL 5.5.5+ | Stores posts, users, orders and settings |
| HTTPS | Recommended host capability | Not listed | Encrypts logins, checkout and member pages |
| Web server | Apache or Nginx | Not listed | Serves requests; WordPress.org asks hosts about mod_rewrite on Apache |
What each component does in plain terms
PHP is the language WordPress is written in. Every page that is not served from cache, including every page a logged-in member sees, is built by PHP. WordPress.org describes PHP 7.4 as past official end of life, and WordPress's Site Health screen flags an outdated PHP version as a security issue. Hosts differ in what they offer: SiteGround's plan page lists managed PHP 8.2 as the default plus custom versions 7.4 and 8.3 to 8.6, and Kinsta lists PHP 7.4 through 8.5.
The database holds everything that is not a file: content, users, orders, quiz attempts. The recommended MySQL 8.0 or MariaDB 10.11 matter less for raw speed than for support status and compatibility with plugins that set higher floors. WooCommerce, for example, asks for MySQL 8.0 or MariaDB 10.6 and a 256 MB WordPress memory limit.
HTTPS needs a certificate on the domain. The web server, Apache or Nginx, passes requests to PHP. WordPress.org's template request to hosts asks whether the account supports Nginx or Apache with the mod_rewrite module.
How four hosting types expose these settings
On managed and shared hosting the provider runs the stack and you choose from what they offer. On an unmanaged cloud server you install and update everything yourself, which gives full control and full responsibility.
| Host type | Example | PHP version control | Database and web server |
|---|---|---|---|
| Shared managed | SiteGround | Managed PHP 8.2 default plus custom versions 7.4 and 8.3 to 8.6 listed on the plan page | Provided by host |
| Managed WordPress | Kinsta | PHP 7.4 to 8.5 offered | Provided by host |
| Managed WordPress | WP Engine | Set by host; confirm available versions before buying | Provided by host; platform limits such as memory and execution time documented |
| Unmanaged cloud server | DigitalOcean Droplet | You install and upgrade PHP | You install and patch MySQL or MariaDB and Apache or Nginx |
Confirming requirements before you buy
Plan pages rarely list database versions. The quickest route is a pre-sales message using WordPress.org's own template questions. If you already have a site, Tools, Site Health, Info has Server and Database sections covering the web server, PHP settings and database, which you can compare against the table above.
- Which PHP versions can I choose, and is 8.3 or newer available today?
- Which MySQL or MariaDB version runs on this plan?
- Is the web server Nginx, or Apache with mod_rewrite?
- Is a free HTTPS certificate included and renewed automatically?
- What is the maximum PHP memory limit I can set?
- For a cloud server: who is responsible for patching the operating system, PHP and database?
Worked example: an old shared plan on PHP 7.4
A course creator's site runs on a shared plan whose panel offers PHP 7.4 and MySQL 5.7. WordPress runs, so nothing looks broken. Against WordPress.org's page, PHP 7.4 and MySQL 5.7 are both below the recommended versions, and WooCommerce 10.8+ would not meet its stated PHP 8.3 requirement.
Option one: ask the host to move the account to a server with PHP 8.3 and MySQL 8.0, then follow a PHP upgrade acceptance test on staging. Option two: migrate to a plan that lists PHP 8.3 or newer in the selector. Either way, the requirement check takes ten minutes in Site Health and saves discovering the gap during a plugin update.
When a VPS changes the picture
On a DigitalOcean Droplet, the requirements become a task list instead of a checkbox. Basic Droplets start at $4 a month for 512 MiB of RAM and 10 GiB of SSD, with $6 for 1 GiB and $12 for 2 GiB; backups cost 20% of the Droplet price weekly or 30% daily. That price includes no PHP, database or web server management, so budget the time to install, configure HTTPS and keep each component inside the recommended versions.
Questions before you decide
What PHP version does WordPress recommend?
WordPress.org recommends PHP 8.3 or greater. It says WordPress still works on PHP 7.4+, but those versions are past official end of life and may expose a site to security vulnerabilities.
Does WordPress need MySQL or MariaDB?
Either. WordPress.org recommends MariaDB 10.11 or greater, or MySQL 8.0 or greater, and notes that WordPress still works with MySQL 5.5.5+ in legacy environments.
Is HTTPS required to run WordPress?
HTTPS support is part of WordPress.org's recommended requirements. For a membership or course site it is essential, because logins, checkout and member pages carry personal and payment details.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- WordPress.org: Requirements Accessed 30 Oct 2026
- WooCommerce Docs: Server requirements Accessed 30 Oct 2026
- SiteGround: Shared hosting features Accessed 30 Oct 2026
- Kinsta Docs: PHP settings and PHP threads Accessed 30 Oct 2026
- WP Engine Support: Platform settings Accessed 30 Oct 2026
- DigitalOcean: Droplet pricing Accessed 30 Oct 2026
- WordPress documentation: Site Health screen Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.