Health Checks After a PHP Patch
By PHP Patch Assurance · Last updated: 2026-10-25 · Plain-text version
A health check after a PHP patch is a list of verifications that the site still works on the new version: the PHP release is running, the application answers, its key actions succeed, and the error log is quiet. It is the gate between 'patched' and 'done' — a patch that has not passed its health check has not finished.
Version and SAPI
Confirm the running release with php -v on the web SAPI — not just the CLI — and confirm the SAPI itself is what you expect. A patch that never reached the web workers is the most common silent failure, and it is caught here.
Application smoke tests
Exercise the pages your users actually touch: home, login, search, checkout or contact, mail. The mitbbs.ai verification checked home, the English edition, mail and the health endpoint, all returning 200, plus webmail reaching the mail server. Pick your own equivalents before patching, not after.
Error log
Read the error log for new fatals, crash loops and out-of-memory kills that were not there before the patch. A new error class appearing right after a patch points at the patch, not at traffic. Compare the rate before and after, not just the latest lines.
TLS and serving
Confirm HTTPS still serves with a valid certificate. A rebuild can touch the web server configuration, and a certificate or listener problem is easy to miss if you only check the application.
Agree the gate in advance
Decide before patching what counts as failure: any smoke test failing, any new fatal class, any page returning 500. If any check fails, roll back first and diagnose second — see the rollback guide. A gate decided after the fact is not a gate.
How long to watch
Watch the first hour closely and the next day's logs before calling the patch done. Some failures — a slow leak, a cron job that only runs nightly — do not show up in the first five minutes.
Check your site free Patch service
This guide pairs with the patch service.
Frequently asked questions
What counts as a health-check failure?
Any smoke test failing, any new class of fatal error, any key page returning 500, or the wrong PHP version still serving. One failed check is enough to roll back; the checks exist so you do not have to argue about it mid-incident.
How long should I watch after a patch?
Closely for the first hour, and through the next day's logs. Nightly jobs and slow leaks do not appear in a five-minute check.
The site is up but something feels subtly wrong?
Compare the error-log rate before and after the patch. A rising rate with no single dramatic error is still a regression — investigate it before it becomes an outage.