Site broken after a PHP upgrade
You raised the PHP version and the site came back as a critical error or a blank page. We read the fatal error, fix the incompatible code, and bring the site onto a supported PHP properly — on a copy first.
Website repair by the people who run production servers: hacked sites cleaned at the root cause, not just scanned; code stranded on old PHP and MySQL modernized to run on a current stack; stores stuck on Magento 1, osCommerce, or Drupal 7 made safe; and CMS customizations untangled so updates stop breaking. Senior-engineer work from the team that has managed production Linux since 2005 — we take the jobs other shops decline. Assessed first, quoted in writing, repaired on a copy while your live site stays up.
call +1-877-378-7436 US Toll Free / +1-213-291-9191 International
These are the tickets that end up on our desk — usually after somebody else said no. If one of them is yours, it is fixable.
You raised the PHP version and the site came back as a critical error or a blank page. We read the fatal error, fix the incompatible code, and bring the site onto a supported PHP properly — on a copy first.
A cleanup that only removes malware leaves the hole open, which is why it keeps happening. We clean the site and close the way in — in the code and on the server, because we work on both.
Malware and injected code removed from files and the database, core and plugins brought current, the vulnerable plugin or theme fixed or replaced — and a plain-English write-up of what happened and what changed.
No security fixes for years, and no new server will run it. We modernize the code — removed functions, changed behaviors, old database calls — until it runs clean on a current, supported PHP.
CentOS 7 is end-of-life, the replacement ships PHP 8 and MySQL 8, and the site will not run there. We make the code fit the server instead of holding the server back for the code.
Patches ended in 2020, but the store still pays the bills. We make it as safe as it can be while you decide, or plan and execute the move — your call, after an honest written assessment.
Twenty-year-old carts, heavily customized, quietly critical. We upgrade them in place where that is sane — or migrate the catalog, customers, and order history to something current.
Still online, no longer patched. We keep it defensible while a migration is planned, or carry out the migration — content, users, and URLs preserved.
Someone once edited core files or the theme directly, and now every update either fails or erases the changes. We untangle the customizations and re-implement them the supported way, so updating becomes boring again.
Nobody dares press the upgrade button, because last time it broke everything. We press it on a copy, fix everything that breaks there, and then bring production forward in one planned, reversible step.
An inherited codebase, no documentation, no handover, and something just broke. We read the code, fix the problem, write down how it actually works, and stay available for the next time.
Custom modules, payment-gateway and provisioning integrations, order-form and theme work — built by a team that runs WHMCS in production itself.
Shops that quote a broken site without reading its code are guessing — and the surprise lands on your invoice. We look before we quote.
You tell us what is wrong and what the site means to your business; we look at the code and the environment it runs in. If access is a concern, a copy of the code and database is enough to start.
What is actually wrong, what we would do about it, and what it costs — in writing, before anything starts. If a rebuild beats a repair, the assessment says so plainly, with numbers for both paths.
The fix happens on a staging copy while your live site keeps running. You test it there, we schedule the cutover, and a backup taken beforehand is the fallback nobody should ever need.
Almost every broken-website problem lives in two places at once. The hack got in through a plugin, but it persists through a writable directory. The white screen is a PHP error, but the PHP version is a server decision. The store is slow because of a query, but the query only became slow after a database upgrade. Shops that only do code and services that only do servers each fix their half and bounce the other half back to you — which is how a site stays broken with two invoices paid.
Server Surgeon has run production Linux servers for hosting companies for 21 years. Repair and modernization work here is done by a senior engineer with that operational record behind them — the same person who reads your code reads your logs, and the engineer who writes the assessment is the engineer who does the work. No handoff to a junior, no partner agency, no guessing about the environment, because in many of these jobs we are already the ones running it.
And when the right answer is not a repair — when the honest move is a rebuild on something current — the assessment says exactly that. We would rather tell you the truth in writing than win the wrong job.
Most hosting companies have a few accounts like this: one that breaks every time an old PHP version is retired, a store on a cart nobody has supported in a decade, a site that gets the shared IP flagged every few months. They generate the most tickets, block your server upgrades, and are the hardest customers to help — because what they need is development work, not hosting support.
Hand them to us. We fix the site, you keep the customer — under your brand or ours, whichever you prefer. We have worked for hosting companies since 2005 and already speak cPanel, Plesk, and DirectAdmin, so the handoff is a ticket, not a project.
New features, integrations, automation, and the ongoing changes to the application you already run — written by an engineer who also understands the server it ships to.
Applications that lean on AWS itself — S3, SES, Lambda, queues, autoscaling-aware design — from a team on AWS since 2006. See AWS Server Management for the operations side of those same environments.
WHMCS modules, gateways, and provisioning glue, cPanel and panel integrations, and the custom tooling hosting companies actually run on — our home turf since 2005.
A repair lasts when the stack behind it stays current. Linux Server Management keeps the server patched and watched 24/7, and managed backups mean any future emergency starts from a good copy.
Rescue work has a reputation for runaway invoices, because the shop discovers the real problem after you have already committed. We run it the other way: the assessment comes first, the scope and price go in writing, and you approve before work starts — no hidden costs. If something found mid-job genuinely changes the picture, you get a revised scope in writing, not a bigger bill after the fact. And everything is yours throughout: the code, the repositories, the credentials, the documentation. Nothing about the engagement is designed to make leaving hard.
“Server Surgeon is awesome! I'm so grateful for your swift responses and help with the server. It's good to feel less of a victim now with a fighting chance against hackers.”
Larry Server Surgeon Customer
“You are a life saver… 4 hours and [company name removed] could not fix the issue… 30 minutes and you're done… Thanks again for the great service!”
Nick Server Surgeon Customer
“We love dealing with you guys. Super professional and saved us on more than one occasion. Thanks again for your excellent service.”
Karen Server Surgeon Customer
These are the questions we hear most often. Search our extensive FAQ here.
We read the error instead of guessing. WordPress writes the reason it went down to its debug log — a fatal error naming the exact file at fault, usually a plugin, a theme, or custom code hitting a PHP version it was never written for. We fix or replace what the log points to, on a copy of the site, and put the live site back when it works. If the damage is deeper, we restore from the most recent good backup and then fix what broke so it does not repeat.
An update changed something the rest of the site depended on — a plugin incompatible with the new WordPress core, a theme built for an older PHP, or edits someone once made directly to core files that the update just overwrote. That last one is the classic hard case: the site only worked because of a customization nobody documented. We find the dependency that snapped, fix it properly, and re-implement any core hacks the right way so future updates stop breaking.
“There has been a critical error on this website” means a fatal PHP error with the details hidden from visitors. Newer PHP removes functions and behaviors that old code relies on, so the first request after the upgrade dies. The server’s error log names the file and line. We take a copy of the site, run it on the new PHP, fix every incompatibility the logs surface, and only then switch production — your visitors never see the debugging.
Yes — if the code is made compatible first. The safe order is: copy the site to a staging environment running the new PHP, fix what breaks there, test, then upgrade production. What often happens instead is the reverse: the version is changed on the live server first, and the site goes down. We do it in the right order, and your live site stays up the whole time.
Almost always, yes. Either the site is cleaned in place — malicious files removed, injected code stripped out of the database — or it is restored from a backup made before the compromise, with anything newer carried across. Recovery is the easy half. The half that matters is closing the way in, which is why our cleanups include the code fix, not just the file removal.
A site that keeps getting hacked is a site where the cleanup never closed the hole: the same outdated plugin, the same abandoned CMS version, the same writable directory. Scan-and-clean services remove the malware and leave the vulnerability, because fixing it is development work. We do the development work — patch or replace the vulnerable code, bring the stack current, tighten the server configuration — and walk you through the password resets that should follow. Then updates keep the door shut; ongoing server management can keep them applied for you.
As of 2026, PHP 8.1 and everything older — 8.0, every 7.x, and 5.6 — no longer receive security fixes. PHP 8.2’s security support runs out at the end of 2026, so modernization work should target PHP 8.3 or newer. If your site is on an unsupported version, the code needs to be made compatible before the server can move — that is exactly the work this page describes.
Yes. MySQL 5.7 reached end of support in October 2023, and even MySQL 8.0 left extended support in 2026 — current servers run MySQL 8.4 or a current MariaDB. Old applications often depend on removed SQL modes, old authentication plugins, or query behaviors that changed, which is why a database upgrade can break a site that ran for years. We upgrade the application and the database together, tested on a copy first.
No — CentOS 7 reached end of life on June 30, 2024, and receives no security patches. Sites stranded on it usually face two problems at once: an unsupported operating system and application code too old for the PHP and MySQL that ship on its replacements. We handle both halves — the server migration to AlmaLinux or Rocky Linux and the code modernization that lets your sites run there.
No. WordPress is written in PHP and that is not changing. What does change is the minimum PHP version WordPress and its plugins support, which is how sites end up stranded: the CMS moves forward, the custom code does not, and one day an update requires a PHP the site cannot run. Modernizing the code closes that gap.
Very much so — PHP powers WordPress, WooCommerce, Drupal, Magento, Laravel applications, and the majority of the hosting world we have managed servers for since 2005. The language is not the risk. The version is. A site on a current, supported PHP is a normal production site; a site on PHP 5.6 is a liability. Modernization moves you from the second group to the first without a rebuild.
Every job starts with an assessment: we look at the code and the environment, tell you in writing what is wrong and what we would do, and quote the work before anything starts — no hidden costs. If something discovered mid-job changes the scope, we come back to you in writing before proceeding; there is never a surprise invoice. Sometimes the honest assessment is that a rebuild beats a repair — if so, the assessment says that too, with numbers.
Yes. Hosting companies have been our core customers since 2005, and their end-customers’ legacy sites are where most of these jobs come from — the account that breaks every time you try to raise the server’s PHP, the store that gets the whole IP flagged. Send us the broken ones. We work under your brand or ours, whichever you prefer, and we already speak cPanel, Plesk, and DirectAdmin.
No. Linux Server Management at $100 per server per month covers the server — the OS, the stack, the panel, 24/7. Repair and modernization is project work on the code that runs on it, quoted per job. They pair well: many repair customers put the server under management afterward, so the stack that just got current stays current.
We have answered many more. Browse our 150+ question FAQ or contact our sales team.
A senior engineer looks at the site, tells you in writing what is wrong and what it costs to fix, and you decide from there. Hacked, stranded, out of date, or “nobody will touch it” — we take the hard jobs.
Or call +1-877-378-7436 US Toll Free / +1-213-291-9191 International
The same team every day, on every server. Three things we promise —
We have handled every common Linux distribution, every panel, and every kind of outage before, and we know how to resolve them.
Every ticket is handled by a senior admin with 8+ years of managing production web hosting servers. No outsourcing, no junior staff logged into your server.
Month-to-month, no fixed-term contract. If we are not the right fit, we refund you without argument. Read the reviews →
Server Surgeon has run production Linux for hosting companies and businesses since 2005. Repair and modernization work extends that record to the code itself — the site and the server it runs on, fixed by one team.
More about Server Surgeon →