Statamic 3 Site Still Works? Here's Why It Needs Upgrading

Statamic 3 came out in August 2020. Built well, a website can serve a business for years, so it's easy to take an "if it ain't broke, don't fix it" attitude.

I understand that thinking. But if your business website still runs Statamic 3, it has security flaws you can't see.

An out-of-date website can be flagged as unsafe by Google, pass malware on to your customers or be taken offline by your host. Here's what it can cost a business.

Why a working Statamic 3 site still needs attention

Your website is built from layers of software. Each layer only gets security fixes for a fixed duration.

Statamic, the content management system (CMS).
Laravel, the framework Statamic is built on.
PHP, the programming language that runs both of them on your server.
Hundreds of smaller packages that handle jobs like sending emails and resizing images.

When a flaw in one of them is fixed, the details become public. A site that never installs the fix stays open to a flaw anyone can read about. Nothing on the front of the site changes, so it feels fine.

If your business website still runs Statamic 3, it has security flaws you can't see.

Which PHP version does a Statamic 3 site run on?

Statamic 3.4, the last version 3 release, runs on PHP 7.4 to 8.1, according to Statamic's support policy. So PHP 8.1 is the newest version a Statamic 3 site can use.

All three of those PHP versions are past their security support.

PHP 7.4 lost it in November 2022
PHP 8.0 in November 2023
PHP 8.1 on 31 December 2025, according to php.net.

That made a difference in October 2026, when PHP fixed two serious flaws known as PHP2Shell. PHP released fixed versions for 8.2 and later only.

Some package maintainers patched older versions too, including the one whose PHP packages Ploi and Laravel Forge use. So whether a server on 8.1 got the fix depends on where its PHP came from, and whether anyone installed it. That maintainer no longer builds PHP for Ubuntu 20.04, so a server that old didn't get these builds.

Updating PHP on its own isn't an option. Statamic 3 isn't supported on PHP 8.2 or later, so getting onto a supported PHP version means upgrading Statamic first.

Statamic and Laravel stopped getting fixes too

Statamic 3's security fixes ended in July 2024. Laravel 8 and 9, the versions underneath it, are past their support as well. This isn't unique to Statamic. Every CMS stops supporting older versions eventually.

A server set up for PHP 8.1 often runs an older operating system too, with its own support dates. That's why my upgrades usually lead into a move to a new server that I keep updated.

Why I start with your site's code repository

Before I price an upgrade, I ask for read access to the site's code repository. That's where its code is stored and tracked, usually on GitHub, GitLab or Bitbucket. It tells me far more than the live site can, and nothing on the live site changes while I look.

From the repository I can see:

The exact versions of Statamic, Laravel and PHP the site is built for.
Every package it uses, checked against published security advisories.
Which addons have a version for current Statamic, and which were abandoned and need replacing.
Custom code that will need adjusting during the upgrade.
Whether it uses Statamic Pro. A Pro licence includes a year of updates and then needs renewing, so a site left alone for years has usually lapsed.
Which tool builds the site's styles and scripts.

That last one can add a step. A build tool turns the styles and scripts a developer writes into the files a browser downloads. Many older Laravel and Statamic sites use Laravel Mix for this. Laravel replaced it with Vite, a newer and faster build tool, as its default in 2022. If your site still uses Mix, moving it to Vite may be part of the upgrade.

That's how I can confirm a price before you commit to anything.

Check who owns the repository. Sites built by freelancers often live in the freelancer's own account. If yours isn't somewhere you can reach, tell me and I'll take a copy from the server instead. Either way, it's worth getting the code into an account your business owns. I can help with that.

Why waiting makes a Statamic 3 upgrade bigger

A Statamic 3 site has at least three major versions to catch up on, each with changes to templates, addons and settings. That makes it the biggest job on my Statamic upgrade page, and every new major release adds another step.

Statamic publishes an upgrade guide for each step, listing the changes that can break a site. Most are small, but on the way from Statamic 3 they add up. For example:

The part of Statamic that reads the site's templates was replaced, so templates need checking.
The rich text editor was rebuilt, so any add-ons for it need updating or replacing.
Some settings and content are stored differently.
The Control Panel was rebuilt on a new version of the software it's made with, so any custom Control Panel features need rewriting.
Laravel and PHP each move up several versions.

Your visitors won't notice any of it, but each change is work to do and test.

The upgrade covers Statamic, Laravel and PHP together. Your pages and documents stay as they are, though the Control Panel will look different.

What to do next

Check your version. In the Statamic Control Panel, open Tools > Updates.
Find out who has access. That means the hosting account, the code repository, and any server tool such as Ploi or Laravel Forge.
Get a price for the upgrade. Send me read access to the repository and I'll confirm what's involved before anything starts.
Keep it updated afterwards. A website maintenance plan updates the site every month, so it never falls this far behind again.

The site can keep doing everything it does today. The upgrade changes the software underneath it.

Your Statamic 3 site still works, but it can't be kept secure