Your website looks up to date. What about the parts you can’t see?

October’s critical PHP updates are a reminder that looking after a website means more than keeping its pages current.

When did you last update your website?

You might have a good answer to that. Perhaps you added photos of a job you finished in Bishop’s Stortford, changed your Saturday opening hours or finally got round to taking an old offer off the homepage.

Now for a slightly different question: when did someone last update the software your website runs on?

That one is harder to answer. You can see the new photos. You can check the opening hours. But a website can look exactly the same before and after an important security update. In October, that distinction mattered.

What happened with PHP?

On 21 October 2026, the team behind PHP released updates to fix two critical security flaws. PHP is software that runs on a web server. WordPress uses it, for example, to do some of the work that turns the content you’ve written into the page a customer sees. You can use a WordPress website every day without ever needing to know its name.

The flaws mattered because, in certain circumstances, someone could run their own code on an affected server without logging in. The UK’s National Cyber Security Centre urged organisations to act immediately. And by 26 October, both flaws were known to have been used in real attacks. That doesn’t mean every affected website was hacked, but it does mean this wasn’t an update to put off until the next redesign.

For business owners, one detail is particularly useful: updating WordPress itself didn’t fix these flaws. Neither did updating every plugin in the dashboard. The problem was in PHP, so the fix needed to happen on the hosting side. Your hosting provider may already have taken care of it, but WordPress advised site owners to check rather than assume.

Isn’t that what I pay my hosting company for?

It’s a fair question. The answer depends on what you’ve agreed with them.

Think about a customer asking for a quote through your website. You might look after the wording on the page. Your web developer might look after the form. Your hosting company might look after the software the form runs on. To the customer, it’s all just one button: Request a quote.

There’s nothing wrong with dividing the work that way. The difficulty comes when the business owner assumes the developer handles updates, the developer thinks the host does it, and nobody has actually checked. On a WordPress site, PHP is installed on the server, while WordPress, its themes and its plugins have updates of their own. Keeping one part current doesn’t tell you whether the others have been looked after.

Not sure where your site stands? Here’s a message you can send to whoever looks after it:

Hi, I saw the news about the October PHP security updates. Does our website use PHP and, if so, can you confirm that the fixes released on 21 October have been applied to our live site? It would also be useful to know which updates you look after and whether there’s anything we need to do ourselves.

You don’t need to know your PHP version to ask that question. And if the answer is that your site is affected and hasn’t been updated, ask your provider to deal with it urgently and check for signs that anyone exploited the flaw in the meantime.

What does good website maintenance look like?

For a small business, we’d suggest agreeing three things with the person who looks after your website.

Know who picks up urgent updates. A monthly review is useful for routine work. A critical security fix shouldn’t sit unnoticed until the next one. Agree who receives those alerts, who acts on them and who lets you know it’s done.

Make sure there’s a backup you can actually use. A more useful question than “Do we have backups?” is “When did we last check we could restore one?” For bigger changes, ask whether they can be tried on a private copy of the site first, especially if you depend on it for bookings or orders.

Check the job your customer came to do. After an update, don’t stop at loading the homepage. Send a test enquiry and make sure it arrives in the right inbox. Try making a booking and check the confirmation comes through. A contact form that says “Thank you” is only doing half its job if nobody at your end gets the message.

That last check is worth doing even when there hasn’t been a security alert. Pick the one thing you’d least like to lose from your website for a week, and try it as a customer would.

At Uncommon Web Design, that’s how we think about support after launch. Sometimes the job is adding a new service page or showing off a project you’re proud of. Sometimes it’s making a change your customers will never notice, then checking their next enquiry still reaches you.

You don’t need to become an expert in PHP to run a local business. You just need to know who’s looking after it, so you’re not finding out for the first time when something goes wrong.