Airworthy – PHP Compatibility & Upgrade Checker

Description

Your host wants you on a newer PHP version. Will your site survive the switch?

Airworthy reads the code of every installed plugin and of your theme (on multisite: every network-enabled theme) and checks it against the PHP version you pick, from PHP 8.0 to PHP 8.6. It also looks each plugin up on WordPress.org to see whether it is still maintained. You get one clear verdict per plugin and theme, before you touch your server settings.

Important: Airworthy helps you plan a PHP upgrade; it doesn’t guarantee one. Always back up your site and test the new PHP version on a staging copy before changing your live site.

What you get

• A verdict for every plugin and theme. Blocker, Unknown, Suppressed, Guarded, Warnings or Ready, each with one plain sentence explaining what it means for you.
• Fewer false alarms. Many plugins carry old code that only runs on old PHP versions, behind a version check. Airworthy recognises those checks and marks that code as guarded instead of broken. In our test of the 30 most popular plugins, this cut the plugins flagged as broken from 4 to 2, and both of those contain code that really would fail on PHP 8.
• Maintenance signals from WordPress.org (if you allow it). Plugins that were closed (removed from the directory), not updated in two years, not tested with recent WordPress versions, or that need a newer PHP version than you picked are called out.
• Know what to do first. Under the overall answer, Airworthy lists the next steps that matter most for your site: update this plugin, replace that closed one, send the findings for your custom code to its developer. Results are grouped into fix before you upgrade, keep an eye on, and all good. Plugins with an update waiting say so, with a one-click update, and Airworthy checks them again once they’re updated.
• Explanations in plain English. Each finding says what changed in PHP, what happens on the new version (the page stops with a fatal error, or PHP only logs a notice for now) and how to fix it, with a short before-and-after code example for the common cases.
• Verdicts on the Plugins screen. After a scan, each plugin’s row on the Plugins screen shows its verdict, such as “PHP 8.4: Ready” or “PHP 8.4: Blocker”, linking to its details. You see it every time you manage your plugins.
• Ready for PHP 8.6. PHP 8.6 is due on 19 November 2026. Airworthy already checks for its deprecations with its own checks, and you can check against its release candidate today.
• Know how long you have. Airworthy shows when your server’s PHP version stops getting security fixes, so you can plan the upgrade before it’s urgent.
• Know when your PHP needs a security update. If your server’s PHP is missing the latest PHP security fixes, Airworthy says so on its screen and in Site Health, and tells you to ask your host to update (a routine update that doesn’t change how your plugins work). It knows that many hosts ship the fixes as an update that keeps the old version number, so it reads when your PHP was built instead of trusting the number alone.
• The details when you want them. Every finding shows the file, the line, what changed in PHP and how to fix it. Filter by verdict, rescan one plugin after an update, copy a plain-text summary to paste into an email or support ticket, or download everything as a CSV file for your developer or host.
• Sensible default. Airworthy recommends the oldest PHP version that still gets security fixes: the smallest upgrade that keeps your site protected. It shows every version’s support dates.
• Safe on any host. Scans run in the background in short batches, so they never time out, and they watch memory use. You can leave the page while a scan runs. Nothing is changed on your site.
• Settings that fit your site. Skip inactive plugins, keep a list of plugins and themes never to check, and choose a gentler scan speed for cheap shared hosting.
• In Site Health too. Tools > Site Health shows whether your plugins and themes are ready for the next PHP version, with a link to the full results.
• Multisite ready. On a network, Airworthy is activated network-wide and lives under Network Admin > Settings.

For freelancers and agencies

Hosts are moving sites off old PHP versions, and every client asks the same question: will my site break? Install Airworthy on each client site before the host’s deadline (it’s free, on as many sites as you like), and you have an answer per plugin in minutes. Copy summary gives you a plain-text list to paste into the client email or the host’s support ticket, the CSV has every finding for your developer, and the Site Health check keeps showing whether the site is ready for the next PHP version. For many sites at once, use WP-CLI.

WP-CLI

Everything on the admin screen also works from the terminal:

• wp airworthy scan --target=8.4 checks every plugin and theme and prints the results. Add --wporg to include the WordPress.org checks.
• wp airworthy scan --only=my-plugin --fail-on=blocker exits with code 1 if anything would break, for CI.
• wp airworthy results --verdict=blocker,unknown shows what needs attention.
• wp airworthy issues <slug> lists one plugin’s findings with file and line.
• wp airworthy rescan <slug>, wp airworthy export --file=report.csv, wp airworthy status, wp airworthy cancel, wp airworthy resume and wp airworthy targets do what their names say.

Privacy

This plugin reads your plugin and theme files on your own server; it never runs them and never sends them anywhere.

Airworthy only contacts an outside server if you allow it. Before your first scan it asks whether to also check WordPress.org, and remembers your answer; you can change it at every scan (in WP-CLI: --wporg or --no-wporg). If you say no, nothing leaves your server.

If you say yes, it looks up each plugin’s slug (its folder name) in the public WordPress.org plugin directory (api.wordpress.org), one plugin per request, to show whether it is still maintained. Nothing else is sent: not your site’s address (the requests use their own “Airworthy” user agent instead of WordPress’s default, which includes your site URL), not your PHP version. As with any web request, WordPress.org sees your server’s IP address. Answers are cached for 24 hours.

Airworthy sets no cookies, adds nothing to your site’s front end, and has no tracking, account or sign-up.

Source code and build

The full, human-readable source code is public at https://github.com/DigitalKind/airworthy.

The scan engine is built from open-source libraries: PHP_CodeSniffer, PHPCompatibility and PHPCSUtils. Other plugins, or your own tools, may load their own copies of these, possibly different versions. To keep the copies apart, the release build runs them through PHP-Scoper (https://github.com/humbug/php-scoper), which moves their code into Airworthy’s own Airworthy\Vendor namespace. The scoped code in the vendor/ folder is ordinary, readable PHP; only the namespace names change.

To rebuild the plugin from source, clone the repository and run bin/build.sh. It installs the exact library versions pinned in plugin/composer.lock, scopes them, checks the result and writes dist/airworthy.zip. docs/ENGINE.md explains each step.

Action Scheduler is bundled unscoped, as WooCommerce and other plugins do, because it is designed to share one copy between all plugins that include it.

Bundled libraries and licences

Airworthy’s own code is GPLv2 or later. It bundles:

• PHP_CodeSniffer 4.0.4: BSD-3-Clause. https://github.com/PHPCSStandards/PHP_CodeSniffer
• PHPCompatibility 10.0.0-alpha2: LGPL-3.0-or-later. https://github.com/PHPCompatibility/PHPCompatibility
• PHPCompatibilityParagonie 2.0.0-alpha2: LGPL-3.0-or-later. https://github.com/PHPCompatibility/PHPCompatibilityParagonie
• PHPCompatibilityWP 3.0.0-alpha2: LGPL-3.0-or-later. https://github.com/PHPCompatibility/PHPCompatibilityWP
• PHPCSUtils 1.2.3: LGPL-3.0-or-later. https://github.com/PHPCSStandards/PHPCSUtils
• Action Scheduler 4.2.0: GPL-3.0-or-later. https://github.com/woocommerce/action-scheduler

Because Action Scheduler is GPLv3 and the PHPCompatibility libraries are LGPLv3, the plugin as distributed, taken as a whole, is covered by the GPL version 3. Each library’s licence file is included in its folder. A software bill of materials (sbom.cdx.json, CycloneDX format) lists every bundled component and version.