White Screen or 500 Error After a PHP Update? + Free WordPress Troubleshooting Checklist
If a PHP update is followed by a white screen, 500 error or WordPress critical-error message, preserve evidence and work from logs. These messages describe a failure, not its cause: they do not by themselves establish a vulnerability, a plugin fault or a compromise. Updated: 1 November 2026.
Start by narrowing the failure
Record the start time and timezone, last known successful use, recent changes, affected URL, login state and reproduction steps. Establish whether the whole site, administration area, one page or only form submission fails. Retain HTTP status and request ID where available; redact personal information from screenshots. If payments or data processing are affected, alert the owner to assess pausing that journey.
Match symptoms to evidence
White screen or Critical Error: ask the developer for the corresponding PHP fatal error.
500 Error: inspect web-server and PHP logs; the status alone does not identify the cause.
502/504: ask the host to examine the upstream service, PHP workers and timeouts rather than assuming a version problem.
One plugin page fails: record inputs and route and compare the component version with the stack trace.
Database connection error: have the host examine the database service and connection configuration rather than treating all failures as the same PHP issue.
Eight troubleshooting checks in order
□ 1. Preserve error records and the change timeline; confirm a usable backup. Expected: log location and a restorable backup. Ask the host to fill either gap before changes.
□ 2. Reproduce in staging with real emails, payments and unnecessary external actions disabled. Expected: a reproducible staging failure. If external actions cannot be isolated, let the developer arrange the test.
□ 3. Compare the actual web PHP version, required extensions and loaded configuration with the previous setup. Expected: a before/after version and extension comparison. Ask the host to verify gaps or differences.
□ 4. Find the first relevant fatal error or exception and record its file, line, time and component version. Expected: the first relevant error correlated with the timeline. A developer should interpret missing or unclear logs.
□ 5. Have the developer test the implicated plugin, theme or custom code, changing one factor at a time. Expected: one recorded change and its retest result. Code changes belong with the developer.
□ 6. If administration is inaccessible, use a maintainer and the official plugin-deactivation procedure. Record the state first; do not start by deleting files or editing the database. Expected: controlled troubleshooting access with settings retained. Without maintenance access, ask the host; do not delete files.
□ 7. After correcting compatibility or configuration, repeat the failed journey and test login, enquiries and transactions. Expected: the failed journey and key business checks pass. Return failures to the maintainer before reopening affected functions.
□ 8. Disable temporary debug output, protect or clean up sensitive logs and document the cause and prevention. Expected: no public error details and a documented cause. Exposed logs or suspected compromise need security expertise.
Use debugging safely
WordPress provides WP_DEBUG, WP_DEBUG_LOG and WP_DEBUG_DISPLAY. A maintainer should configure logging in staging without exposing error details to visitors. Where short production logging is necessary, restrict access and the collection period. Never post complete logs, passwords, cookies or API keys in a public forum.
Free resource: PHP Update Troubleshooting Template
The editable Word resource contains the eight checks, symptom/evidence fields, a one-change-at-a-time record and an example handover. It turns a vague report into something a developer can reproduce. Links arrive by email; email, intended use and an initially unchecked subscription choice for occasional Allua marketing updates are required. Unsubscribe at any time.
Example of a useful technical handover
Illustrative report: 31 October 2026, 14:20 HKT; logged-out visitors receive a 500 response when submitting /enquiry after the update. The homepage works and staging reproduces the failure. Logs show a fatal error in the relevant plugin at that time. Logs have been retained; the plugin has not been disabled. Please assess compatibility and choose a remedy. This is a reporting example, not a real customer incident or a confirmed root cause.
Frequently asked questions
Q: Should we just raise memory_limit?
A: Investigate first. Limit changes can affect availability and are not a universal fix or security patch.
Q: Can we deactivate every plugin?
A: WordPress documents this technique, but it affects functionality. Use backups, an appropriate test plan and a maintainer.
Q: Is reverting PHP enough if the site works again?
A: It suggests a relationship with the change. Compatibility and security still require resolution.
Q: Does a 500 error mean we were hacked?
A: Not necessarily. If there are also unfamiliar accounts or redirects, open a separate incident investigation.
Make the handover useful
For an Allua website-maintenance enquiry, provide the URL, failure time, scope and redacted screenshots. Do not send login credentials publicly. Enquiries: https://www.alluatech.com/contact-us
Official references
WordPress troubleshooting: https://wordpress.org/documentation/article/faq-troubleshooting/
WordPress debugging: https://developer.wordpress.org/advanced-administration/debug/debug-wordpress/
PHP security announcements: https://www.php.net/
Disclaimer
This article is based on general scenarios and information available as of the stated update date. It is for general information only and does not replace a professional assessment of your individual system. Hosting environments, PHP versions, configurations, plugins and integrations vary. Before updating software, changing settings, restoring a system or taking other action, consult a professional web developer or hosting provider to assess your specific circumstances and determine the appropriate action. If you suspect a compromise, also seek help from a professional experienced in cybersecurity incident response.
Comments