Statamic 4 Site Still Works? Here's Why It Needs Upgrading

Statamic 4 came out in 2023, so most sites built on it are only a few years old. They still look current, the Control Panel works, and nothing seems wrong. It's easy to decide that if it ain't broke, there's nothing to fix.

The software underneath has a shelf life, though, and Statamic 4's has run out. Its security fixes stopped in September 2024. The site still works. It just stopped getting safer.

An out-of-date website can be flagged as unsafe by Google, pass malware on to your customers or be taken offline by your host. Here's what it can cost a business.

Why a working Statamic 4 site still needs upgrading

A Statamic site runs on three main layers of software. There's Statamic, the content management system (CMS) you edit pages in, and Laravel, the framework it's built on. Then there's PHP, the programming language that runs both on your server. Hundreds of smaller packages sit alongside them.

Each one gets security fixes for a fixed period, then stops. Once a flaw is fixed, its details are public. A site that never gets the fix stays open to it, the website keep loading as normal, so nobody notices.

Being out of date isn't the same as being hacked. But attacks are automated, and they try every site they can reach, looking for one that's missing a fix.

The site still works. It just stopped getting safer.

Which PHP version does a Statamic 4 site run on?

Statamic 4 runs on PHP 8.0 to 8.3, according to Statamic's support policy. A site built in 2023 or 2024 most likely went live on PHP 8.1 or 8.2, the usual choices at the time, and has stayed there unless someone moved it.

Here's where each version stands, according to php.net:

PHP 8.0 lost its security support in November 2023.
PHP 8.1 lost it on 31 December 2025.
PHP 8.2 security support ends on 31 December 2026.
PHP 8.3 runs to 31 December 2027.

The difference showed in October 2026, when PHP fixed two serious flaws known as PHP2Shell. PHP released fixed versions for 8.2 and later only.

Some package maintainers patched older versions too, including the one whose PHP packages Ploi and Laravel Forge use. So whether a server on 8.0 or 8.1 got the fix depends on where its PHP came from, and whether anyone installed it. That maintainer no longer builds PHP for Ubuntu 20.04, so a server that old didn't get these builds.

Why moving to PHP 8.3 isn't enough

A Statamic 4 site can move to PHP 8.3, which buys time on the PHP layer. It doesn't help Statamic or Laravel. Statamic 4's own fixes stopped in September 2024, and Laravel 10, the newest version it runs on, lost its security support in February 2025.

This isn't unique to Statamic. Every CMS stops supporting older versions eventually. The way forward is the same: upgrade Statamic, and Laravel and PHP move up with it.

If your business holds Cyber Essentials, the UK government-backed security certification, it expects the same. Software in scope has to be supported, with high-risk fixes installed within 14 days.

Why I look at the code repository first

Before I quote, I ask for read access to your site's code repository. That's where its code is stored and tracked, usually on GitHub, GitLab or Bitbucket. Nothing on the live site changes while I look.

It shows me:

Which versions of Statamic, Laravel and PHP the site is built for, down to the exact release.
Every package installed, checked against published security advisories.
Which addons have a version for current Statamic, and which need replacing.
Any custom code the upgrade will touch.
Whether it was updated within Statamic 4 after launch. A site still on an early 4.x release has also missed the fixes Statamic 4 did get.
Which tool builds the site's styles and scripts.

That last one can add a step. A build tool turns the styles and scripts a developer writes into the files a browser downloads. Laravel switched its default from Laravel Mix to Vite, a newer and faster build tool, in 2022, so a Statamic 4 site could use either. If yours still uses Mix, moving it to Vite may be part of the upgrade.

With that, I can confirm the price before you commit. If you don't know where the repository is, or there isn't one, tell me and I'll take a copy from the server. If a freelancer built the site, check the code sits in an account your business owns.

Why waiting makes a Statamic 4 upgrade bigger

A Statamic 4 site has at least two major versions to catch up on. Each one changes some templates, addons and settings, and the Statamic 4 upgrade is priced to match. Every new major release adds another step.

Statamic's upgrade guide for each step lists the changes that can break a site. On the way from Statamic 4, for example:

Some settings and content are stored differently.
Default values set up in the Control Panel can now appear on the website itself, so pages need checking.
The Control Panel was rebuilt on a new version of the software it's made with, so any custom Control Panel features need rewriting.
Dates are handled differently, which can affect sites with events or dated posts.

Your visitors won't notice any of it, but each change is work to do and test.

Your pages and content stay as they are. The Control Panel will look different, and the newer versions bring useful changes of their own.

What to do next

Check your version. In the Control Panel, open Tools > Updates.
Find the repository. Ask whoever built the site for read access, or tell me there isn't one.
Get a price. I'll confirm what's involved before anything starts.
Keep it updated afterwards. Monthly website maintenance stops it falling behind again.

Upgrading while the gap is two major versions is a smaller job than waiting until it becomes three.

Still on Statamic 4? Updating PHP isn't enough