An old PHP version is slower and, once it leaves security support, stops receiving fixes for problems that are public. Upgrading is usually painless; the risk comes from switching without checking, and the check takes ten minutes.

Find out what will break, first

composer require --dev php-parallel-lint/php-parallel-lint\nvendor/bin/parallel-lint --exclude vendor .

That parses every file against the running version and names anything that will not compile. It does not catch behaviour changes, but it catches the syntax ones, which is most of them.

Test on a copy

  1. Copy the site to a staging subdomain —
  2. Switch THAT to the new version — In EGPNL, per site.
  3. Turn errors on for staging only — display_errors on there and never on live.
  4. Walk the paths that matter — Log in, submit a form, check out, run the cron script by hand.

What usually breaks

  • An abandoned plugin or library using something removed years ago.
  • Passing null where a string is expected - a deprecation in 8.1 that becomes noise in the log rather than an error, but a lot of it.
  • An extension that is not installed for the new version - each version has its own set, and this is the most common surprise.
php -m   # under the new version, compare against the old

Going back

Switching the version back in the panel is instant and changes nothing else, so the worst case is a few minutes. That is what makes trying it cheap.

Check the log after switching, not just the pages. A deprecation writes on every request and can fill a disk in a day even though nothing looks wrong.
Move one version at a time. 7.4 to 8.3 in one jump gives you every change at once with no way to tell which one broke what.