website security updates
WordPress and PHP both recently released critical security fixes.
WordPress shipped patched versions of the system in July and September. On October 21, PHP, the language WordPress runs on, fixed two critical flaws nicknamed PHP2Shell that let attackers run code on a web server without logging in.
What does this mean?
Attackers now turn new flaws into working attacks within hours, often with AI's help. Here's what to check on your website and the tools around it.
What's changed is how fast attackers move once a fix is public. They were trying to exploit the July WordPress flaw roughly 90 minutes after the update went out, and probing the September one less than five hours after its patch became available. Your risk sits in the gap between a fix existing and your site running it.
How does this affect us?
What that means for a small team
If your site gets updated when someone on staff has a free afternoon, that schedule was built for attackers who needed weeks. Start with PHP2Shell:
• Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open Server.
• If you're on PHP 8.1 or older, there's no patch for your version. You need to move to a newer PHP branch, and that change should be tested before it goes live.
• If you're on PHP 8.1 or older, there's no patch for your version. You need to move to a newer PHP branch, and that change should be tested before it goes live.
How We Can Help
You get a scored report on the ten areas attackers check first, including how those protections hold up together, and a roadmap ranked by risk. We also confirm your site is patched against PHP2Shell and, if your host allows it, apply the update during the check. We are offering this service for $500 for a limited time.
What We Will Look AtThe Ten Areas We'll Check
PHP. Current version, whether it includes the latest security fixes, including PHP2Shell, and how long your PHP branch stays supported. If your host allows it, we apply the patch-level update during the check.
SSL and HTTPS. Certificate validity and expiry date, auto-renewal, TLS versions, HTTP to HTTPS redirects, mixed content, and HSTS.
WordPress core, plugins, and themes. Outdated versions, plugins with known vulnerabilities, plugins abandoned by their developers or pulled from the directory, and inactive plugins that should be removed.
User accounts and login. Number of administrators, stale or shared admin accounts, a default "admin" username, two-factor coverage and login rate limiting.
Exposed files and endpoints. Public debug logs, backup copies of config files, exposed .git folders, directory listing, XML-RPC and username exposure through the REST API.
Security headers. Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Backups. Whether backups run, whether they're stored off the server, when the last good one finished and whether anyone has tested a restore.
Firewall and hosting. Whether a WAF or CDN sits in front of the site, whether the server's real address is exposed so attackers can go around it, and whether the server advertises its software versions.
Blocklists and malware. Google Safe Browsing and public malware scanners.
Email domain security. SPF, DKIM and DMARC records, including whether DMARC is set to block spoofed mail or only monitor it. These decide whether your newsletters, donation receipts and HubSpot emails land in inboxes and whether someone can spoof your domain.
We can help in other ways
Hosting, Security & Monitoring
Managed Website Hosting
Your site runs on fast, secure servers that we manage for you. We handle updates and nightly backups so your team never has to think about them.
24/7 Uptime Monitoring
We watch your site around the clock and get alerted the moment something breaks. Most issues are fixed before your visitors or donors ever notice.
Security Scans & Hardening
We scan your site for malware, outdated plugins and known exploits, then close the gaps. You get a plain-language explanation of what we found and fixed.
Website, Marketing & AI
Custom Website Development
We build WordPress and HubSpot sites around how your organization actually works. Your team can update pages without waiting on a developer.
Marketing & AI Strategy
We plan your campaigns, email and automation around your fundraising and program goals. That includes practical AI tools that save your staff hours every week.
On-Demand Support Hours
Submit a ticket for site edits, new landing pages or email builds, and our team picks it up. You only pay for the hours you use.