On 20 October the PHP developers warned about two serious vulnerabilities. Both scored 9.2 out of 10. Depending on the configuration, an attacker could use them to run code on a vulnerable server. A day later, hundreds of Dutch websites went dark as a precaution.
According to the NCSC, no abuse had been seen at that point. Still, all those organisations chose to take their sites offline. That says enough about how big the risk of an open flaw in PHP is.
Why this affects so many websites
PHP runs a large part of the web, and WordPress is built on it. A flaw in PHP therefore does not affect one website, but everything that runs on it: the site itself, the admin area and every plugin. Whoever manages the server has to install the update themselves. Until then, the only safe choice is to take the site offline.
How we do it differently
We do not build websites and software on PHP or WordPress. We work with modern programming languages and frameworks, where a website is built in advance and served as fixed pages. There is no PHP server running code on every visit, and no third-party plugins that leave a door open. Such a site therefore has no PHP server that this specific flaw can affect.
That does not mean such a site is risk-free. No website is. Modern software also has dependencies that sometimes turn out to contain a flaw, and a pre-built site still sits on a server and behind a domain name that both need to be properly secured. The difference lies in how much code is exposed to visitors and who is responsible for keeping it updated.
Updates are part of our care, not your job. Hosting, security updates and backups are handled by the same team that builds the site, so nobody has to remember to press a button. Updates and backups are a standard part of our care, precisely because there is always a next flaw.
What we build and look after for you
Websites: fast, easy to find and without plugins or an admin panel exposed to the internet. We build them on modern frameworks and host them ourselves.
Online stores: ordering and payments without separate WordPress or WooCommerce plugins you have to keep up to date yourself.
Software for your industry: quotes, planning, invoices and a client portal in one system, built on the same secure foundation.
Hosting and care: hosting, security updates, daily backups and small changes are handled by us. You do not have to think about any of it.
Is your website running on WordPress? Here is how to approach it
A WordPress site is not unsafe by definition. Many problems arise because nobody really feels responsible for maintenance. These steps help you get it clear:
- Ask who manages the server: your hosting provider, your web developer or you. Ask which PHP version is running and whether the security update for these flaws has been installed.
- Update WordPress, theme and plugins: make a backup first, then update everything and check that forms, payments and bookings still work.
- Clear out plugins: remove plugins you do not use, even if they are deactivated. Every plugin is code someone has to maintain.
- Secure the login: turn on two-step verification for all administrators, use unique passwords and remove accounts of former staff or previous developers.
- Check your backups: make sure there is a copy outside the server and that someone knows how to restore it.
- Agree who does updates: decide who does them and how often, and who you call when a new flaw appears.
Switch or stay?
If your current site works well and maintenance is properly arranged, there is no need to switch. If you notice updates being left undone, nobody knowing which plugins are running or something breaking with every update, it is sensible to look at a setup with fewer moving parts.
Want to know how your current website is doing? Run the free website check. Want to switch? We move your site without losing your place in Google (this is how to approach a website migration). Start your intake and we will reply within one working day.